The Archdiocese of Indianapolis, a religious organization overseeing a network of parishes, schools, and social service ministries throughout central Indiana, reported a data security incident to the Indiana Attorney General’s Office affecting employees, students, donors, and other individuals whose personal information it maintained. Religious and educational organizations that collect sensitive employee, student, and donor records have a responsibility to safeguard that information from unauthorized access.
Archdiocese of Indianapolis’s Data Breach Investigation
According to a filing with the Indiana Attorney General’s Office, the Archdiocese of Indianapolis discovered a data security incident on December 19, 2024 and reported it to the state on March 18, 2025. The organization has also since reported the incident to the Vermont Attorney General’s Office, which received the filing on July 28, 2026, confirming at least one Vermont resident was affected in addition to those notified in Indiana. The Archdiocese has not publicly disclosed the total number of individuals affected nationwide or the specific method attackers used to gain access to its systems.
Religious institutions and affiliated schools often maintain an unusually broad range of personal data in one place: employee payroll and HR records, student enrollment and family information, and donor financial details, all within organizations that may not have the dedicated cybersecurity resources of a large corporation. This combination can make them an appealing target, since a single successful intrusion can expose several distinct categories of sensitive data belonging to employees, students, parents, and donors alike.
The data types reported in connection with this incident, including Social Security numbers, dates of birth, and financial account information, are among the most useful categories of information for identity thieves, since they can be combined to open new credit accounts, file fraudulent tax returns, or apply for loans in a victim’s name. When student and parent/guardian information is also involved, the risk extends to minors, whose clean credit histories make them a particular target for long-term identity theft that can go undetected for years.
The roughly 15-month gap between the reported December 2024 discovery date and the March 2025 notification to Indiana regulators, followed by an additional filing with Vermont more than a year later in July 2026, illustrates how organizations sometimes continue identifying additional affected individuals or additional states requiring notification well after their initial public disclosure. Affected individuals should not assume that an earlier notification means the matter is fully resolved.
When Did This Breach Occur?
The Archdiocese of Indianapolis has stated that the underlying security incident occurred on December 19, 2024. The organization notified the Indiana Attorney General’s Office of the breach on March 18, 2025, and a separate notification was filed with the Vermont Attorney General’s Office on July 28, 2026, confirming that at least one Vermont resident’s information was also involved.
What Information Was Breached?
Based on available reporting, the data exposed in this incident may include names, Social Security numbers, dates of birth, home addresses, contact information, financial account information, student ID numbers, and parent or guardian information. The Archdiocese has not confirmed which specific categories applied to every individual affected, and not everyone impacted necessarily had all of these data types exposed. If you received a notification letter directly from the Archdiocese of Indianapolis, it should specify exactly what personal information of yours was involved.
What You Can Do
If you believe you may have been affected by the Archdiocese of Indianapolis data breach, consider taking the following steps:
- Place a fraud alert or credit freeze with the three major credit bureaus, especially important given the reported exposure of Social Security numbers.
- Monitor your credit reports and bank statements regularly for unauthorized activity.
- If your child’s information may have been exposed through the student or parent/guardian data reported in this incident, consider checking whether a credit file already exists in their name, which can be an early sign of child identity theft.
- Be alert for phishing emails, texts, or phone calls that reference this breach or claim to be from the Archdiocese or a related parish or school.
- Keep any notification letter you receive, as it may be needed to support a legal claim.
File a Data Breach Lawsuit Against Archdiocese of Indianapolis
If you were notified that your personal information was compromised in the Archdiocese of Indianapolis data breach, you may have legal options available to you. Organizations that collect and retain sensitive personal, financial, and student data are expected to implement reasonable safeguards, and when those safeguards fail, affected individuals may be entitled to compensation.
Contact us at Class Action U, where we’ll connect you with a lawyer skilled in class action lawsuits. If you’ve been contacted about this breach, received notice, or discovered you were impacted, fill out our quick, easy, and secure form to sign up. There is no cost to reach out to our legal partner and no obligation after speaking with someone from our team.
