South Korea's Yoido Full Gospel and SaRang Churches Hacked; Data of 1 Million Members Leaked

Two of South Korea's largest churches have been hit by cyberattacks, with evidence indicating that sensitive data—including personal information and offering records of approximately 1 million congregants—was leaked. Traces of artificial intelligence (AI) use in the attack process have raised growing concerns across the security industry.

Oasis Security, a cyber threat intelligence firm, announced on the 6th that while tracking multiple IP addresses suspected of being used in hacking last month, it discovered an attacker server containing large volumes of personal information and hacking logs. The source of the data on the server was confirmed to be the integrated information system of Yoido Full Gospel Church in Seoul's Yeouido district and the human resources information system of SaRang Community Church in Seoul's Seocho district.

Yoido Full Gospel Church was found to have been breached when attackers used a web shell (malicious program) to infiltrate its enterprise resource planning (ERP) system and then seize database administrator privileges. A large volume of data recorded as exfiltrated in August was discovered on overseas servers, including approximately 960,000 member records updated over the past two years, 330,000 offering entries, over 68,000 electronic approval documents, and more than 14,700 internal messenger conversations—totaling 47.3GB. The member information included names, addresses, and phone numbers, as well as sensitive details such as offering histories spanning from 1993 to 2019.

Kim Geun-yong, CEO of Oasis Security, said the attackers had already confirmed the web shell paths they successfully exploited, adding, "A Korean church was attacked, and this is how the files were exfiltrated."

Hacking data targeting SaRang Community Church was also found on the same server. Analysis indicates the attackers breached the groupware server using previously acquired account credentials, then exploited vulnerabilities to expand access to the ERP system via single sign-on (SSO) functionality. Through this, the names, addresses, and phone numbers of 286 staff members—including the senior pastor—and approximately 89,000 congregants were leaked.

Combined, the two churches' personal information breach totals approximately 1.05 million records.

Evidence of AI Use and Attack Methods

Multiple traces suggesting AI was leveraged were discovered during the hacking process. Records documenting the attack included the term "sub-agent," referring to an AI that executes commands, and more than several hundred "attack handover reports" were found on the server, summarizing the hacking results, internal system architecture, and account information.

Nam Kyung-hun, a director at Oasis Security, explained, "The AI-analyzed content was extremely well documented in a way humans could understand, and the volume of analyzed data was enormous—exceeding several hundred documents."

Additionally, evidence emerged that administrator accounts and infrastructure obtained during a breach of a U.S.-based religious content and streaming service were repurposed to target South Korean churches.

However, the security firm assesses that, given the attack methods, the likelihood that this is the same perpetrator behind the recent series of cyberattacks on South Korea's financial sector is low.

Church Response and Security Authority Actions

Oasis Security reported the suspected hacking incident to security authorities last month, and the Korea Internet & Security Agency (KISA) recently notified both churches of the situation.

Upon notification, Yoido Full Gospel Church immediately initiated an emergency security audit of the affected systems. The church stated, "We are verifying the exact facts, and if personal information leakage is confirmed, we will respond swiftly and transparently in accordance with relevant laws and regulations." The church also plans to directly explain the situation and response progress to congregants during the upcoming Wednesday service.

SaRang Community Church likewise recognized the breach indicators and immediately formed an emergency task force (TF), completed reporting to relevant agencies, and is focusing on preventing further damage.

Security Industry Warnings

This incident demonstrates that religious institutions' information security frameworks may be relatively more vulnerable compared to corporations or financial institutions. Churches store congregants' addresses and phone numbers, as well as offering records, electronic approval documents, and internal messenger conversations in a single location, making them attractive targets for attackers.

Oasis Security urged, "The connectivity and authentication and authorization frameworks of core business systems—including HR, accounting, and groupware—must be comprehensively reviewed."

The leaked information reportedly includes unique identifiers such as resident registration numbers, raising concerns potential secondary harm targeting congregants. If offering records are leaked, an individual's financial capacity could be exposed, creating opportunities for voice phishing or targeted fraud.

Security experts point out that AI-assisted hacking is becoming increasingly sophisticated. The evidence that attackers used AI to automatically analyze stolen data and even generate handover documents suggests that future cyberattack patterns may become even more organized.

Once added, BigGo Finance appears first in Google Top Stories, so you get the broadest, most up-to-the-minute, and most comprehensive global financial news first.