South Korean Megachurches Investigate Data Breaches Affecting Hundreds of Thousands

Two of South Korea’s largest Protestant churches are investigating suspected cyberattacks that may have exposed personal information belonging to hundreds of thousands of congregants and employees.

Yoido Full Gospel Church in Seoul’s Yeouido district said an internal review found that a dataset containing names, dates of birth and change histories for 850,000 members may have been compromised. The review began after the Korea Internet and Security Agency notified the church of a suspected breach on Tuesday afternoon. Outside cybersecurity specialists were brought in to examine potentially leaked records and system access logs.

The church said six of seven datasets reviewed did not contain personal information. Those files covered administrative matters including transfers between parish districts, appointments to church positions and baptisms. The seventh dataset, however, recorded changes to members’ personal details. It included 2,629 entries involving changes to resident registration numbers, 3,964 involving telephone numbers and 7,202 involving addresses.

Yoido Full Gospel Church responded by blocking external access to its systems and changing server passwords. It also plans to replace its firewall, identify vulnerabilities with help from security companies and reinforce its defenses.

Evidence of a separate breach was also reported at Sarang Church in Seoul’s Seocho district. Logs indicated that information connected to about 286 employees, including the senior pastor, and roughly 89,000 church members was stolen in August. Sarang Church has formed an emergency task force, reported the suspected incident to the relevant authorities and begun work to establish what happened and prevent further damage.

The suspected compromises came to light after cybersecurity company Oasis Security traced internet addresses associated with alleged attacks and found church-linked data, account information and attack records on an external server. Investigators reportedly found logs showing where a web shell had been planted in a church system. A web shell is a malicious file that can give an attacker remote access to a server. The records also raised the possibility that artificial intelligence tools were involved, although responsibility for the attacks has not been publicly established.

The incidents add to concerns over a wider series of cyberattacks in South Korea. Police opened a major investigation this week into suspected AI-assisted attacks against financial institutions that exposed personal data belonging to tens of thousands of customers. The church cases broaden the potential scope of the threat beyond heavily regulated financial companies to large civic and religious organizations holding extensive membership databases.

Authorities and the churches are still assessing the scale of the exposure. The figures disclosed so far describe records that may have been compromised and do not by themselves establish that every listed individual’s information was misused.