Inside the Concordia Publishing House Database Breach: 95K Accounts

HEROIC analysts catalogued a database breach affecting Concordia Publishing House, the publishing arm of the Lutheran Church-Missouri Synod, discovered on July 24, 2024. The incident exposed exactly 95,546 customer records, comprising email addresses, Argon2 password hashes, first names, and last names. The breach demonstrates that no sector is immune to data theft, including non-profit religious publishers that collect user account data through their online storefront at cph.org.

Why This Is Dangerous

Although Argon2 is a modern, memory-hard hashing algorithm, it is not impenetrable. Attackers who obtain these hashes can run offline cracking attacks, particularly against accounts where users chose short or common passwords. Once a password is cracked, the attacker gains access not just to the victim's Concordia Publishing House account but potentially to any other service where that password was reused. Combined with verified full names and email addresses, threat actors can also launch highly personalized phishing campaigns, impersonating Concordia or trusted organizations to extract additional credentials or payment information.

What Was Exposed

• Email Address
• Password Hash (Argon2)
• First Name
• Last Name

Why This Matters

Even hashed passwords create real risk when they reach the dark web. Threat actors can attempt credential stuffing attacks using these email addresses against banking, email, and shopping platforms, banking on password reuse. Full names paired with email addresses also lower the barrier for identity fraud and social engineering. For an organization managing the accounts of tens of thousands of customers connected to a religious institution, this breach additionally carries reputational risk that extends beyond the technical exposure.

How Database Breaches Work

A database breach occurs when attackers gain unauthorized access to the backend data store of a website or application. Common methods include exploiting SQL injection vulnerabilities in web applications, using stolen or brute-forced database administrator credentials, or accessing misconfigured databases exposed directly to the internet. Once inside, attackers can export entire tables of user records silently, often without triggering alerts. The stolen data is then typically sold or freely posted on dark web forums, where other criminals can use it for follow-on attacks.

Check If You Are Affected

If you have ever created an account with Concordia Publishing House, your email address and password hash may be part of this exposure. Use the HEROIC free breach scanner to check your email against our database of over 400 billion compromised records. If your email appears, change your Concordia Publishing House password immediately and update that password anywhere else you have used it.