Modern churches are digital. From streaming services and online tithing to storing prayer requests and nursery check-in data, Texas churches rely heavily on technology. While this digital shift expands a church's reach, it also opens a new backdoor for criminals.
The $80,000 Mistake in Plano
A vibrant congregation in Plano, Texas, was in the middle of a fundraising campaign to repair their youth facility. The church administrator received an email that appeared to come directly from the general contractor handling the repairs. In the email, the contractor requested a progress payment of $80,000. They sent a new wire transfer link for the church to comply with the payment.
Trusting the email, the administrator wired the funds. Two weeks later, the real contractor called asking for payment. The church had fallen victim to a phishing and social engineering attack. The email was a spoofed account run by hackers. Because the money was wired voluntarily, the bank could not recover it. Without a cyber liability policy featuring social engineering coverage, that $80,000 of donor money was gone forever, halting the youth building project entirely.
Why Hackers Target Churches
Many church boards believe they are too small to be targeted by cybercriminals. And some even believe that their general liability policy will cover them. In reality, GL doesn't cover cyber hacks and hackers view churches as prime targets for three specific reasons:
- Soft Security Targets: Unlike major corporations, most churches do not have full-time IT security teams or enterprise-grade firewalls. Cybercriminals look for these weak points.
- Sensitive Private Data: Church databases hold a treasure trove of sensitive information, including names, home addresses, children’s nursery data, and bank or credit card routing info from online giving.
- The Trust Factor: Churches operate on a culture of trust. Staff members are naturally inclined to be helpful, making them highly susceptible to email scams and social engineering.
First-Party vs. Third-Party Cyber Coverage
A robust Cyber Liability policy provides protection in two distinct ways:
- First-Party Coverage (Your Immediate Costs): This covers the direct expenses the church faces to recover from an attack. It includes paying for IT forensics to find the hacker, ransomware negotiation fees, data restoration costs, and the expensive legal notification process required by Texas state law if donor data is exposed.
- Third-Party Coverage (Your Legal Defense): If a congregant sues the church because their identity was stolen due to a church data breach, this side of the policy pays for the church's legal defense, court costs, and any settlements or regulatory fines.
The Online Giving Misconception
A common refrain from church leaders is, "We use a third-party app for giving, so we don't have cyber risk." While the giving platform might secure the credit card transaction, the church still holds data. If a hacker gains access to your church administrative software (like Church Community Builder or Planning Center), they can still steal email addresses, phone numbers, and demographic data. Furthermore, third-party apps do not protect your church computers from being locked down by a malicious ransomware attack.
Securing Your Church’s Online Presence
In Texas, a data breach isn't just an inconvenience. It can destroy the trust you've spent decades building.
Are your digital doors wide open? Relying on basic anti-virus software is no longer enough to protect your church’s digital assets. Our personalized risk assessment looks at your church's online giving, database storage and online streaming to craft a Cyber Liability policy that protects your church's finances and your congregation's privacy.