In the last two years, ransomware groups have hit churches by name. First Baptist Church in High Springs was struck by the BlackLock ransomware gang. First United Methodist Church in Boerne, Texas had sensitive personal and financial data leaked after an attack claimed by the Interlock ransomware group. Greater Mt Calvary Holy Church in Washington, D.C. was hit by RansomHub. These are not isolated incidents. Cybersecurity researchers now estimate that nearly 43 percent of North American cyberattacks target ministries and nonprofits specifically, not despite their size, but because of it.
If you serve on staff at a church anywhere in the greater Atlanta area, whether you are the Senior Pastor, the Financial Pastor, a ministry assistant, or the volunteer coordinator, this is not a problem that belongs to “IT people” somewhere else. It belongs to your church, right now, and the data backs that up.
Why Churches Specifically Are Being Targeted
It is worth understanding why churches have become such an attractive target, because the reasons are specific and worth taking seriously.
- Churches handle real money, often without enterprise-grade protection. Online giving platforms move significant dollar amounts through digital channels every week. Attackers know that the financial sector is one of the most targeted industries in the world, and they have realized that churches process similar volumes of financial transactions with far fewer security safeguards in place.
- Staff culture is built on trust, and attackers exploit that directly. Ministry staff are, by nature and by calling, helpful and trusting. That is a strength in ministry and a vulnerability in a phishing attack. A convincing email that appears to come from the Senior Pastor, asking the Financial Pastor to process an urgent wire transfer for a building project or a benevolence request, is one of the most common and most successful attacks targeting churches today.
- Most churches do not have a documented cybersecurity policy. Industry research shows that roughly 70 percent of nonprofits, churches included, have no formal cybersecurity policy in place, even though 60 percent have experienced an attack within the last two years. Attackers know this gap exists, and they target it. This mirrors what we see across small businesses generally — see the most common cybersecurity gaps we find during a free IT review for a sense of how often these basics get missed.
- Church databases hold exactly the kind of data criminals want. Member directories, family information from child check-in systems, giving histories, and staff payroll records all sit inside the same systems a church uses every day to run its ministry. A breach does not just cost money. It breaks the trust a congregation places in its church to protect their personal information.
What This Looks Like in Practice
The most common attacks we see and hear about across the industry follow a consistent pattern, and it is worth naming them specifically so staff know what to watch for.
- Phishing emails impersonating leadership. An email arrives that looks like it came from the Pastor or Executive Pastor, often using a slightly altered email address, asking for an urgent financial transaction, a gift card purchase, or updated banking information for a vendor. These messages are designed to create urgency and bypass careful thinking.
- Ransomware that locks church systems entirely. Attackers gain access through a single compromised password or a clicked link, then encrypt the church’s files and demand payment to restore access — typically through one of the same three paths ransomware uses to get into any small organization. This can shut down everything from email to the giving platform to the database used for Sunday morning check-in, sometimes for days at a time.
- Compromised credentials sold or leaked online. When a staff member reuses a password across multiple accounts, a breach at an unrelated website can hand attackers the same password they need to access the church’s email or financial systems.
What Atlanta-Area Churches Should Actually Be Doing
The good news is that the most effective defenses are not expensive enterprise security products. They are disciplined, consistent practices that any church staff can maintain with the right IT partner.
- Multi-factor authentication on every account that touches money or member data. This single control stops the vast majority of account takeover attempts, even when a password has been compromised. Email, giving platforms, and your church management system should all require it.
- Ongoing staff and volunteer training, not a one-time session. Phishing tactics evolve constantly. A staff team that was trained on phishing two years ago is not prepared for the attacks circulating today. Regular, short training keeps awareness current without overwhelming a busy staff.
- A clear process for verifying financial requests. Any request to change banking details, send a wire transfer, or process an unusual payment should require verification through a second channel, like a phone call to a known number, before it is acted on. This single habit defeats the leadership impersonation attacks described above.
- Documented offboarding for staff and volunteers. When a staff member or key volunteer leaves, their access to email, the giving platform, and the church management system needs to be removed promptly and consistently, not eventually.
- Backups that are tested, not just scheduled. A ransomware attack is far less damaging to a church with current, verified backups stored separately from the main network. Many churches have backups in place that have never actually been tested for restoration.
- A written incident response plan. If an attack does happen, staff should already know who to call, what to do first, and how to communicate with the congregation, rather than figuring it out in the middle of a crisis.
Why TekNation Is Built for This
TekNation already works with churches across the greater Atlanta area, and we have seen firsthand how different ministry technology needs are from a typical small business client. A few things shape how we approach church clients specifically:
- We understand the trust dynamic inside a church staff. We design security controls, like financial request verification and access management, that work with the way church staff actually operate day to day, rather than fighting against it.
- We help churches use Microsoft’s nonprofit licensing to afford real protection. Multi-factor authentication, conditional access, and device compliance through Microsoft 365 Business Premium are well within reach for most churches once nonprofit pricing is applied correctly, something many churches never realize they qualify for.
- We treat the church management platform as part of the security picture, not separate from it. Whether your church runs Planning Center, Realm, or another system entirely, the access to that platform needs to be governed with the same discipline as your email and financial systems, because it holds the same kind of sensitive data.
- We are local. Being based in the greater Atlanta area means we understand the regional church community, we are available when something urgent comes up, and we are not a call center reading from a script when your staff needs real help.
Frequently Asked Questions
Why are churches becoming targets for ransomware attacks?
Churches process significant online giving revenue with fewer security controls than most businesses, and a staff culture built on trust makes phishing and wire-transfer scams easier to pull off. Researchers now estimate that nearly 43 percent of North American cyberattacks target ministries and nonprofits specifically.
What is the single most effective cybersecurity control for a church?
Multi-factor authentication on every account tied to money or member data. It stops the vast majority of account takeover attempts even when a password has already been stolen, and it should cover email, giving platforms, and your church management system.
Does Microsoft offer discounted licensing for churches?
Yes. Churches and other faith-based nonprofits often qualify for Microsoft 365 nonprofit pricing, which makes multi-factor authentication, conditional access, and device compliance far more affordable than most staff realize.
What should a church do first if it doesn’t have a cybersecurity policy?
Start with a security assessment to identify who has access to financial systems, whether backups are actually tested, and where multi-factor authentication is missing. From there, build a written policy and incident response plan around those specific findings.
How much does a church cybersecurity assessment cost?
TekNation performs a straightforward security assessment for churches and faith-based organizations across the greater Atlanta area. Reach out directly for current pricing and to schedule a time.
Getting Started
If your church does not currently have a documented cybersecurity policy, has not reviewed who still has access to financial systems after a staff change, or simply is not sure where the gaps are, that is the right place to start a conversation. TekNation can perform a straightforward security assessment of your current environment and show you exactly where your ministry is exposed and what it would take to close those gaps.
We are based in Douglasville, GA and proudly serve churches and faith-based organizations throughout the greater Atlanta area. Reach out to schedule a cybersecurity assessment for your ministry.
Ready to protect your church staff and your congregation’s trust? Contact TekNation today.