Cyberattacks expose member data, donation records at two Seoul megachurches, report says

Two major churches in Seoul appear to have suffered cyberattacks that exposed members’ personal information, donation history, accounting records and internal documents.

Security firm Oasis Security recovered attack tools and logs from an overseas attacker’s server last month and found large amounts of information linked to Yoido Full Gospel Church in Yeongdeungpo District, western Seoul, and SaRang Church in Seocho District, southern Seoul, the company said on Tuesday.

The server contained about 330,000 donation records from Yoido Full Gospel Church that appeared to have been stolen in August, along with information on about 960,000 church members that had been updated over the past two years, Oasis Security said.

The company also found that about 68,000 electronic approval documents and 14,706 records of conversations on an internal messaging system were leaked.

Data believed to have been stolen from SaRang Church’s human resources system was also found on the server. The files contained 286 records on employees and officials, including the senior pastor, as well as information on more than 89,000 church members.

“We were recently notified by the Korea Internet & Security Agency of signs that personal information related to the church’s information system may have been leaked,” Yoido Full Gospel Church said in a statement on Wednesday. “We are currently working with the relevant authorities and security experts to determine exactly what happened.”

The church said it launched an emergency security inspection of the affected system and began taking protective measures as soon as it became aware of the suspected breach. It is investigating whether an external intrusion occurred, how it happened and what types and amounts of information may have been affected. The church is also strengthening security to prevent further damage.

SaRang Church also found signs of a possible personal data leak and formed an emergency response task force. The church reported the incident to the relevant authorities and said it has begun investigating the cause and is taking steps to prevent further damage.

AI may also have been used in the attacks. Oasis Security cited logs from the attack process that referred to a “sub-agent,” a term for an AI system that carries out commands. The server also contained an “attack handover report” that summarized the hacking results, internal system structure and account information.

The news comes after major commercial banks such as KB Kookmin, Hana and Shinhan suffered AI-based hacking attacks recently.

“The attacker appears to have exploited authentication and authorization vulnerabilities to expand access to major internal systems,” Oasis Security said. “Large amounts of sensitive information appear to have been stolen, including church members’ personal data, donation and accounting records, electronic approval documents and account information.”

BY KIM JI-HYE [[email protected]]