Two of South Korea’s biggest churches say member data may have been exposed after suspected hacks, putting faith communities into a harsh tech spotlight.
Story Snapshot
- Yoido Full Gospel Church reported possible exposure of records tied to 850,000 members.
- Sarang Church-linked files, including member and staff details, were found on an attacker’s server.
- A security firm described a web shell on a church system and database administrator access.
- Media reports converge on large-scale exposure across two megachurches under active review.
What the Churches Say Happened
Yoido Full Gospel Church said its internal review found names, birth dates, and other personal details for about 850,000 members may have been leaked. The church also said some personal information appeared in the modification history of member records, which investigators flagged during the review. These statements frame the event as a suspected intrusion into a very large congregation, with sensitive data fields that go beyond simple contact lists. The church has begun security checks and containment steps in response.
Reports also describe files tied to Sarang Community Church on an external attacker server. The data allegedly includes names, addresses, and phone numbers for about 89,000 members, plus records for 286 staff and officials, including the senior pastor. These details suggest the attacker searched for both rank-and-file congregant information and leadership data. That mix often points to identity risk, social engineering risk, and the chance of targeted scams aimed at high-profile figures and their networks.
How Investigators Believe Attackers Got In
Independent security analysis cited a technical path that fits known attack playbooks. Oasis Security said a web shell on a church enterprise system allowed the attacker to gain a foothold. The attacker then obtained database administrator privileges, which would unlock broad access to member and donation data if present on connected systems. This method aligns with common breaches at large institutions: a quiet door in, then privilege growth, then discovery of valuable data.
Several outlets reported that attack tools, logs, and copied files sat on an overseas attacker server. These reports linked that server to both Yoido Full Gospel Church and Sarang Community Church datasets, including recent membership updates and accounting-related records. Such a find usually triggers emergency checks, password resets, and stronger access controls. It also calls for careful notice to affected people and coordination with law enforcement when criminal activity is suspected.
Why This Scale Matters in Korea
South Korea treats contact details, addresses, and any resident identification changes as highly sensitive. Churches also hold donation histories, family ties, and service records that can carry social weight. When a megachurch says hundreds of thousands of member records may be exposed, the stakes go beyond spam or nuisance calls. The risk can include identity fraud, targeted scams, and community pressure tied to faith or giving patterns, especially if donation or change-history files are involved.
#southkorea#MegaChurches#probe#Suspected#ailinked#CyberAttack
SEOUL, Oct 7 – Two South Korean megachurches are investigating suspected cyberattacks that may have exposed the personal data of hundreds of thousands of congregants, with evidence suggesting AI tools may pic.twitter.com/4OCOZENkeb— Raashid Saeed (@raashidsaeed3) October 7, 2026
Large institutions often learn about breaches after outside analysts find data or tools on attacker servers. Early counts then vary as investigators separate unique people from update logs and duplicates. That explains why coverage ranged from tens of thousands of members at one church to 850,000 at another and up to around 960,000 total records across the two. Precision comes later, but the direction of travel is clear: two megachurches are treating this as a serious privacy incident.
What Sensible Protection Looks Like Now
Churches and similar groups can harden defenses without fancy gear. Leaders should review administrator accounts, enforce multi-factor login, and eliminate shared passwords. Regular backups and test restores keep options open if systems lock up or get altered. Clear roles for who patches systems, who watches logs, and who contacts members after an incident protect the flock and the mission. These steps reflect common sense and align with conservative values of stewardship and accountability.
Members should tighten their side, too. Freeze credit if worried about identity theft. Be wary of texts or calls that use real church details to push urgent requests. Verify any donation change or data update through known church channels, not links in emails. Simple habits block most scams that follow publicized breaches. That is how families protect both their wallets and their peace of mind while institutions finish their cleanup and notification work.
What to Watch Next
Look for formal notices from each church with specific impacted fields and steps for members. Watch for confirmation of any law enforcement engagement and any published technical indicators tied to the web shell or privilege escalation. Expect updates that refine the counts as teams de-duplicate logs and reconcile files. The core facts stand firm today: two of South Korea’s largest churches are probing suspected cyberattacks that touched large stores of member data, and they are moving to respond.
Sources:
asiae.co.kr, en.sedaily.com, chosun.com, news.sbs.co.kr
