How the Episcopal Church Foundation Prevented a Cyberattack

The Episcopal Church Foundation (ECF) recently shared its experience with an attempted cyberattack to raise awareness and help safeguard other faith-based organizations. On January 25, 2025, ECF faced a brute force cyberattack, in which a malicious actor attempted to gain unauthorized access to its systems using stolen email addresses and guessed passwords from over 400 IP addresses. Fortunately, the attack was unsuccessful due to the organization’s proactive cybersecurity measures, including the use of multi-factor authentication (MFA) and the disabling of legacy authentication, which prevented access via outdated username-password methods.

The incident came shortly after several Episcopal organizations, including ECF, received harassing messages following the National Cathedral prayer service for President Donald Trump’s inauguration. While the timing was notable, there was no confirmed connection between the events.

The attack was discovered while ECF was investigating an unrelated cybersecurity issue involving a third-party IT vendor. This separate incident is still under investigation, and ECF has since severed ties with the vendor. In sharing its experience, ECF aims to emphasize the rising threat of cyberattacks on churches and nonprofits, encouraging them to review their digital defenses.

Key takeaways include:

• Implement MFA to add a layer of security beyond passwords.

• Disable legacy authentication to avoid vulnerabilities during transition periods.

• Monitor networks for unusual activity and respond swiftly to threats.

• Educate staff and volunteers on best practices for digital security.

ECF’s transparency has already prompted other Episcopal organizations to evaluate their cybersecurity posture. The foundation encourages churches and ministries to take proactive steps now, as the frequency and complexity of cyberattacks targeting religious institutions continue to grow.