Dear friends,

We are writing to let you know about a serious data security incident at St John’s Meads, and to explain what happened, what it means for you, and what we are doing about it.

We are sorry this has happened. It came about through an honest mistake of the kind any of us could make, but we know you entrusted your personal information to us, and we are taking it seriously and doing what we can to make sure it doesn’t happen again.

What happened

On the morning of Wednesday 22 July, a member of our office team opened and read a fraudulent email. It was designed to look as though it came from Ruth, our vicar, but it was in fact sent by someone outside the church impersonating her. This is a type of scam known as "phishing," and these emails are increasingly sophisticated and convincing.

The email asked for a copy of our contact list. Believing the request to be genuine, a member of our team replied with the information. As soon as the mistake was realised, we acted immediately in our response.

We want to reassure you that this was a one-off disclosure made by email in response to a fraudulent request. Our systems were not broken into, and our membership database itself remains secure.

What information was involved

The information disclosed was limited to contact details for members of our church community: names, home addresses, telephone and mobile phone numbers, and email addresses.

We want to reassure you that no financial information of any kind was involved, and no data relating to children was included.

What this means for you

There is no risk to your bank accounts or finances from this incident. However, because your contact details may now be held by an unknown party, we would ask you to be alert over the coming weeks to:

• Unexpected emails, texts or phone calls, particularly any that create a sense of urgency or ask you to share personal or financial information

• Messages that appear to come from the church, our clergy or staff but feel unusual - if in doubt, please contact the office directly to check before responding

As a general rule, neither the church nor any legitimate organisation will ever ask you to share bank details or passwords by email, text or phone.

We would also gently ask you to look out for one another. If you know someone in our church family who might find messages like these harder to spot, particularly older or more vulnerable members, a quiet word to put them on their guard would be a real kindness.

What we are doing

We are treating this very seriously. So far, we have:

• Contacted the Diocese of Chichester and acted on their advice

• Made contact with the National Cyber Security Centre

• Contacted the neighbourhood policing team

• Reported it to the Information Commissioner’s Office (the UK’s data protection regulator)

• Started preparing a serious incident report for the Charity Commission

• Documented how the incident happened and discussed steps to strengthen our safeguards

We are also arranging additional training for our staff team so that requests of this kind are verified before any information is shared.

Where to find further advice

If you’d like to read more or take extra precautions, the following may be helpful:

• If you’re concerned about how your information has been handled - the Information Commissioner’s Office explains your rights and the steps you can take:  https://ico.org.uk/for-the-public/i-m-worried-about-how-an-organisation-has-handled-my-information/ 

• Recognising and dealing with phishing scams - the National Cyber Security Centre’s guidance on spotting suspicious messages and protecting yourself: https://www.ncsc.gov.uk/collection/phishing-scams 

• Reporting suspicious emails, websites and texts - how to report anything suspicious you receive, so it can be investigated and taken down: https://www.gov.uk/report-suspicious-emails-websites-phishing 

If you have any questions

Please don’t hesitate to get in touch. Any of us would be glad to talk things through:

• Revd Ruth Robinson, Vicar - vicar@stjm.org.uk

• David Scott Ralphs, Churchwarden - wardendavid@stjm.org.uk

• Ian Brown, Churchwarden - wardenian@stjm.org.uk

• Jorj Kowszun, Parish Safeguarding Officer - safeguarding@stjm.org.uk

Please be assured that we are handling this with care. We apologise sincerely for what has happened and for any distress it may cause you. We are doing everything we can to make sure this does not happen again. Thank you for your understanding and continued support.

With every blessing,

Revd Ruth Robinson, Vicar 

David Scott Ralphs, and Ian Brown, Churchwardens