September 24, 2026
What Happens to Your Members When a Church Database Is Hacked
If you pastor a church, you hold information about people. Names. Phone numbers. Who is new. Who asked for prayer. It may live in a notebook, a spreadsheet on your laptop, or an app on your phone. Wherever it lives, it can be taken.
So the question is not whether your church keeps records. Every church does. The question is what happens to the people in them if the wrong person ever reads them.
Pastors often tell me the same thing. I am not a technical person. This is not my world. I will keep this plain, then, because the harm lands on your members rather than on your computers.
Writing things down is not the problem
Keeping notes about your people is not a failure of trust. It is part of caring well.
Paul wrote letters full of names and details. He settled a quarrel between two women in Philippi by naming them both. He remembered Timothy’s mother, his grandmother, and his bad stomach. He knew who was ill and who had wandered off. “Besides those things that are outside, there is that which presses on me daily: anxiety for all the assemblies” (2 Corinthians 11:28). You cannot carry anxiety for people you cannot remember.
So writing things down is a shepherd’s instinct, two thousand years old. What has changed is only where the writing goes.
Paul kept names and needs close at hand. Pastoral notes are the same instinct, and they deserve the same care.
Where your member list actually lives
When you type a member’s name into an app or an online spreadsheet, that information does not stay on your phone. It travels to a computer belonging to the company that makes the app, or to one they rent from somebody else. A hosting company rents out computers the way a storage firm rents out units. Thousands of unrelated businesses keep their things in the same building.
This matters for one reason. Your church can have strong passwords and a careful team, and your members’ details can still get out, because a company you have never heard of was broken into. You had no say in it. You may never have known the company existed.
In 2023, security researchers found that a Brazilian church software provider had left a database exposed online; the files contained personal data belonging to roughly 932,000 church members, and researchers warned the information could be used for targeted phishing, identity theft and doxxing. In 2022, The Church of Jesus Christ of Latter-day Saints disclosed that attackers had reached systems holding members’ usernames, full names, email addresses, birthdates, mailing addresses and phone numbers. Small congregations are affected too: a Presbyterian church in the United States notified around 1,000 people after an external breach of its systems in early 2026.
None of those churches were careless about their people. They trusted software, which every church has to do.
A church list is different
If my own name and email leaked tomorrow, I would shrug. I am an engineer with a public profile, so I am already easy to find. But a church list is not a customer list.
A church list tells the reader what you believe.
European law says the same. Article 9 of the GDPR puts information about someone’s religion in a special category. Holding it is forbidden unless a specific rule allows it, such as the person clearly agreeing. The law guards a name attached to a church as closely as it guards medical records, because either one can be used to hurt the person it describes. (I am a software engineer rather than a lawyer, so this is general information and not legal advice.)
The convert from a hostile country. She came to faith from a Muslim family, and she still goes home to see them. A leaked list puts her name, her phone number and her church where anyone can search for them. Open Doors’ 2026 World Watch List reports 388 million Christians facing high levels of persecution and discrimination, more than one in seven believers worldwide. For that sister, a breach is not an inconvenience. It is a risk to her freedom and possibly her safety.
The couple who asked you to pray over their relationship. They came forward together one Sunday. You wrote the request down, with both their names on it. A year later the relationship ended. Neither of them would choose to have that moment published.
The man who wrote one honest sentence about his depression. He put it in the space you provided for prayer requests, because he trusted that it would go no further than you.
A prayer request is written in trust. It should stay sealed to everyone except the people meant to pray over it.
When a shop is breached, people lose money. When a church is breached, people lose their privacy about the tenderest things in their lives. Their faith. Their marriage. Their drinking. Their grief.
What happens the week after
Money can be replaced. Trust takes much longer.
Members stop writing anything down. They give a nickname only. They carry the same burdens into the same building and hand none of them over. And they take that caution with them to the next church, and the one after that.
Paul’s picture of the church is a body. “If one member suffers, all the members suffer with it” (1 Corinthians 12:26). A body works because the parts report to each other. When a toe goes numb, the injury does not stop. Only the knowledge of it stops.
The damage continues quietly and unnoticed. Only the knowledge of it stops.
The paper notebook is not the safe alternative
Some pastors react by going backwards. No software, just a book. I understand, but a book has its own ways of going wrong. It can be left on a train. It can vanish during a move. It can be lent to a leader helping with a family matter and never come back. And unlike a computer record, you will probably never learn that someone read it.
The goal is not to avoid technology. The goal is to make sure that if the worst happens, there is nothing readable to take.
What encryption changes
This is the one technical idea worth your time.
Encryption turns readable information into nonsense. A name, a phone number, a prayer request all become a jumble that nobody can read without the right key. What matters is who holds that key. In the kind of system worth having, your church holds it, along with the people you choose. The company that makes the software does not.
That is how Velyora is built. Your members’ names, contacts, birthdays and prayer requests are locked on their own device before they ever reach us. I cannot read them. If someone broke into the systems holding it, they would find nothing they could turn back into a person. No name to match to a church, and no prayer request to publish.
I would rather no attack ever came. But if one did, I would want you to be able to tell your congregation the truth. They took a locked box, and no key exists that opens it.
Velyora was built by a church member with encryption from the first line, so a stolen copy holds nothing readable about your people.
You do not need to understand cryptography to give your people that. You only need to pick tools built with them in mind.
The same care belongs anywhere you keep track of people, including the teenager who quietly stops showing up. Knowing matters. Protecting what you know matters just as much.
Frequently asked questions
Is a small church really a target?
Attackers rarely pick churches by name. They look for weak systems and take whatever is inside. A congregation of eighty can be caught through the same provider as a congregation of eight thousand. The Presbyterian church mentioned above had to notify around 1,000 people.
Does GDPR apply to a church?
Usually yes, if your church is in the EU or EEA, or if you hold details of people who are. Article 9 puts information about someone’s religion in a special category, which you may only hold if a specific rule allows it. One such rule is that the person clearly agreed. A membership list attached to a church reveals belief simply by existing. This is general information rather than legal advice, so ask a qualified adviser about your own situation.
What should we do if our church data is breached?
Stop it spreading. Find out what was taken. Then tell your members the truth, soon, rather than hoping it passes. You may also have a legal duty to tell your data protection authority, often within days, so get legal advice early. And reach out first to the members most at risk, such as converts from hostile countries.
Does encryption mean we can stop being careful?
No. Encryption protects what you store. It does not decide what you collect, who can see it, or how long you keep it. Collect only what helps you care for people. Give each helper access only to the people they serve. And look through it once a year.
Give each helper the key to the people they serve, and to no one else.
Can I still keep prayer requests at all?
Yes, and I think you should. Prayer requests are one of the clearest signs that a church is a family rather than an audience. Keep them because you will pray over them. Tell people plainly how they are protected. And make sure nobody outside the few people who need them can read a word.
Some members only write down what weighs on them when they know their name can stay off it.
The name Velyora comes from velad y orad, watch and pray. Watching over a flock means knowing your people, and protecting them means keeping that knowledge where it belongs. You can try Velyora free and have your QR code ready before Sunday.