 |
| Yoido Full Gospel Church |
Suspected cyberattacks on two of Seoul’s most prominent megachurches—Yoido Full Gospel Church, long regarded as one of the world’s largest Protestant congregations, and SaRang Church—have potentially compromised the personal information of hundreds of thousands of members.
Security researchers uncovered stolen records and attack artifacts on an overseas server, with early assessments pointing to data tied to roughly 850,000 people at Yoido and about 89,000 congregants plus 286 staff at SaRang. The incidents, which appear to have unfolded in August 2026, coincide with a wave of suspected AI-assisted hacks against South Korean banks and raise broader questions about the cybersecurity posture of large religious institutions that hold vast amounts of sensitive personal and financial data.
Cybersecurity firm Oasis Security publicly detailed its findings in early October 2026 after recovering files from a U.S.-based attacker server (IP 192.3.239.164) between late August and early September. The material included attack tools, logs, account credentials, and large volumes of church-related data. For Yoido Full Gospel Church, researchers identified roughly 47.3 gigabytes of material: approximately 960,000 member records updated over the prior two years, about 330,000 donation or offering records, around 68,000 electronic approval documents, and more than 14,000 internal messaging records. At SaRang Church, the recovered files included personal details on more than 89,000 members and human-resources records for 286 employees and officials, including the senior pastor. Attackers also accessed information linked to a college ministry and other assets.
Yoido Full Gospel Church confirmed it was notified by the Korea Internet & Security Agency (KISA) on the afternoon of October 6. In its own review of seven suspected datasets, the church determined that six—covering parish transfers, appointments, and baptism histories—contained no personal information. The seventh, a log of changes to membership records, held names and dates of birth for approximately 850,000 individuals, along with 2,629 entries recording changes to resident registration numbers, 3,964 to phone numbers, and 7,202 to addresses. The church noted that resident registration numbers had been collected primarily to issue donation receipts for year-end tax settlements. It also stated that older donation records (1993–2019) consisted of voucher numbers, amounts, and details without associated personal identifiers such as names or addresses.
Senior Pastor Lee Young-hoon issued a public apology. “I feel a deep sense of responsibility for causing concern among our members as a result of this incident, and I sincerely apologize,” he said. “As soon as we became aware of the circumstances surrounding the incident, the church worked with the relevant authorities and cybersecurity specialists to identify the method of intrusion and the extent of the damage, while taking measures to prevent any further harm.” The church has blocked external access to its systems, changed server passwords, begun notifying potentially affected members in line with South Korea’s Personal Information Protection Act, and plans to install a new firewall while engaging external security firms for further vulnerability assessments.
SaRang Church, located in Seoul’s Seocho district, reported forming an emergency response team, notifying authorities, and investigating the scope of the incident. Attack logs indicated the data was taken in August. Neither church has publicly determined the precise initial access vector, though both are cooperating with investigators.
Oasis Security’s technical analysis painted a more detailed picture of the intrusions. At Yoido (referred to as Victim A in the firm’s report), attackers appear to have used a web shell on an enterprise resource planning (ERP) system to gain administrator-level access. They conducted reverse engineering of security components, leveraged linked-server remote code execution, bypassed database monitoring controls, accessed network-attached storage, and staged data on a pre-positioned MinIO object storage bucket. At SaRang (Victim B), the path involved previously obtained credentials and insecure direct object reference vulnerabilities in groupware and related systems, followed by single-sign-on access to SAP systems used for human resources. Researchers also noted that infrastructure previously associated with the compromise of an unnamed U.S.-based Christian content platform was reused, suggesting possible continuity in the attackers’ operations against religious targets.
Particularly notable were references in the attack logs to “sub-agents” and lengthy, apparently automated attack reports. In AI systems, sub-agents function as helper processes that an overarching model can spawn to handle discrete tasks—scanning, exploitation, data extraction, or reporting. Oasis Security observed these indicators alongside machine-generated documentation of the intrusion, though the precise degree of AI autonomy remains unclear. The findings align with parallel investigations into recent breaches at South Korean financial institutions.
In late September and early October 2026, multiple banks and lenders—including Shinhan Bank, KB Kookmin Bank, Hana Bank, and others—reported data exposures affecting tens of thousands of customers. Shinhan disclosed that information on roughly 25,000 customers (names, phone numbers, annual incomes, and loan limits) had been accessed through a service used by external loan agents.
President Lee Jae-myung publicly noted signs of AI involvement in some of these incidents. Security researchers have pointed to tools such as ARTEX, an autonomous penetration-testing framework that can orchestrate multiple AI models to identify vulnerabilities and chart attack paths. The overlapping timing and AI indicators have fueled speculation about shared tooling or operators, though investigators have not confirmed a direct link between the church and bank campaigns.
Historical and Institutional Context
Yoido Full Gospel Church occupies a unique place in global Pentecostalism. Founded in 1958 by Pastor David Yonggi Cho and his mother-in-law Choi Ja-shil in a tent in a poor Seoul neighborhood, it grew through an innovative cell-group system into a congregation that, at its peak, claimed hundreds of thousands of members and was recognized by Guinness as the world’s largest. Cho, who died in 2021, emphasized healing, prosperity theology, and rapid multiplication of small groups led largely by laywomen. The main sanctuary on Yeouido (an island in the Han River that has become Seoul’s financial district) seats thousands and hosts multiple Sunday services. The church is affiliated with the Assemblies of God and continues under Senior Pastor Lee Young-hoon. Its scale means it manages extensive membership databases, donation histories, and administrative systems—precisely the kind of concentrated personal data that attracts sophisticated attackers. en.wikipedia.org
SaRang Church (also rendered Sarang or SaRang Community Church) was founded in 1978 by Pastor Ok Han-heum (also known as John Oak or Han-Heum Oak) in southern Seoul. Ok, a Presbyterian minister influenced by Reformed theology and discipleship training models, built the congregation through systematic lay leadership development. By the time of his death in 2010, the church reported tens of thousands of members and regular Sunday attendance in the tens of thousands. It has continued under subsequent leadership and remains one of Korea’s larger Presbyterian congregations, with significant outreach and educational ministries. Like Yoido, its administrative systems hold membership rolls, staff records, and operational data that, if compromised, can facilitate identity theft, targeted social engineering, or further intrusions. en.wikipedia.org
South Korea’s 13-digit resident registration number system makes data breaches particularly consequential. The number encodes a person’s birth date and is widely used by banks, telecommunications providers, and government agencies for identity verification. Organizations are legally restricted in how they collect and retain these numbers, and the Personal Information Protection Act mandates notification of affected individuals when leaks occur. Exposure of even partial records—names, birth dates, addresses, and phone numbers—can enable fraud, phishing, or doxxing, especially when combined with other breached datasets.
Analysis and Broader Implications
These incidents illustrate several converging trends. First, large religious organizations often operate complex internal systems (ERP, groupware, membership databases, donation tracking) that may not receive the same continuous security investment as financial or government infrastructure. Membership data is highly structured and valuable for both criminal monetization and potential intelligence purposes. Second, the apparent use of AI agents lowers the barrier to sophisticated multi-stage attacks. Automated reconnaissance, vulnerability chaining, reverse engineering of proprietary software, and structured reporting can compress the timeline from initial access to large-scale exfiltration, giving defenders less opportunity to detect and contain activity.
Third, the reuse of infrastructure previously tied to a U.S. Christian platform suggests attackers may be specializing in religious or faith-based targets, possibly because such organizations hold both personal data and financial records while sometimes maintaining less mature security operations centers. The presence of donation histories, internal chat logs, and staff records expands the potential harm beyond simple identity theft into reputational damage, internal disruption, or targeted harassment of leaders.
For the affected churches, the immediate priorities are transparent notification, password and access resets, forensic analysis in coordination with KISA and law enforcement, and longer-term hardening—firewalls, continuous monitoring, least-privilege access, and regular external audits. Members should monitor for unusual financial activity, be alert to phishing that leverages personal details, and consider credit monitoring where available.
More broadly, the episode underscores that no sector is immune as AI-augmented tooling proliferates. Religious institutions that serve as community anchors and hold decades of congregational records face a dual challenge: maintaining the trust that underpins voluntary membership while treating cybersecurity as a core pastoral and fiduciary responsibility. South Korea’s experience in late 2026—spanning banks and megachurches—offers a clear signal that defenders must adapt as quickly as the attackers’ automated systems.
The full scope of the breaches, the identities of the operators, and any additional affected systems remain under investigation. Both churches have pledged continued cooperation with authorities and enhanced protective measures. For the hundreds of thousands of people whose information may have been exposed, the coming weeks of notifications and monitoring will determine the real-world impact of what appears to be one of the more significant data security failures involving South Korean religious organizations in recent years.
Samuel O. Sulaimon is the founder and Editor-in-Chief of Naijapiz. He covers News, Sports, Finance, Faiths, Education, Technology.
Post a Comment