Hackers target two South Korean megachurches, potentially exposing congregant data
Hackers breached two South Korean megachurches, potentially exposing personal and financial data of hundreds of thousands of members.
Yoido Full Gospel Church and SaRang Church are investigating cyberattacks that may have exposed member and employee data. Yoido identified personal information associated with about 850,000 members, while Oasis Security linked a second intrusion to records on roughly 89,000 members and HR files for 286 employees. Attackers deployed a web shell, reused leaked passwords, and exploited flaws in internal applications to reach databases, SAP software, credentials, and network storage. The intrusions likely occurred in August and reused infrastructure from an earlier compromise of a U.S.-based Christian content platform; researchers said the attackers also used AI.
- Yoido Full Gospel Church found personal data linked to about 850,000 members.
- Second intrusion exposed about 89,000 members and HR files for 286 employees.
- Attackers used a web shell, leaked passwords, and flaws in internal apps.
- They reached SAP systems, payroll records, credentials, and network storage.
- Infrastructure overlapped an earlier breach of a U.S. Christian content platform.
- ATT&CK
- T1505.003 Web ShellT1078 Valid AccountsT1098 Account ManipulationT1213 Data from Information RepositoriesT1039 Data from Network Shared Drive
- Vendors
- SAP
- Products
- SAP
- Organizations
- Oasis Security
- Countries
- South KoreaUnited States
From the original article
3 min read at therecord.mediaTwo of South Korea's largest Protestant churches are investigating cyberattacks that may have exposed sensitive information about hundreds of thousands of members, including personal details, financial records and internal documents.
therecord.media
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.