Overview
- Yoido Full Gospel Church said on Wednesday that initial analysis found a change-log dataset that may have exposed personal details for about 850,000 members, including names and dates of birth and a smaller number of ID, address and phone-number updates.
- Cybersecurity firm Oasis Security located an overseas server holding stolen files and automated attack records that showed where attackers planted a web shell, a malicious backdoor used to run commands and copy data from the churches' systems.
- Oasis' logs contain references to "sub-agents" and long automated reports that investigators say are consistent with AI-assisted toolchains used to plan or execute intrusions.
- Sarang Church reported an earlier breach that logs show stole personnel records for about 286 employees, including the senior pastor, and data for roughly 89,000 members, and both churches have set up emergency teams and notified authorities.
- National authorities have opened a full-scale probe after related hacks hit banks including Shinhan Bank, and officials warn the exposed name, birthdate and ID fragments raise risks of identity fraud while churches move to block access, reset credentials and hire outside security firms.