Hackers Breach Two Major South Korean Churches, Exposing Data of Over 1 Million People
Attackers breached two South Korean churches, exposing roughly one million congregant records and financial data.
OASIS reported that attackers breached two major South Korean churches and collected congregant, donation, payroll, and identity data. A web shell in the first church’s ERP system led to Microsoft SQL Server administrator access, about 960,000 congregant records including resident registration numbers, roughly 330,000 donation records, and 47.3 GB staged in a MinIO bucket. The second intrusion used leaked credentials and insecure direct object reference flaws to reach about 89,000 congregant records plus employee data. Researchers recovered tooling and stolen files from U.S. server 192.3.239.164 between August 28 and September 1, 2026; the churches were not named and unique-person totals remain unverified.
- A web shell in one church ERP led to about 960,000 congregant records.
- Stolen data included resident registration numbers and 330,000 donation records.
- A second church lost about 89,000 records via leaked credentials and IDOR.
- Researchers found 47.3 GB staged in a compromised MinIO bucket.
- Victim churches were not named, and unique-person totals are unverified.
- ATT&CK
- T1505.003 Web ShellT1078 Valid AccountsT1190 Exploit Public-Facing ApplicationT1059.003 Windows Command ShellT1567.002 Exfiltration to Cloud Storage
- Organizations
- OASIS
- Countries
- South KoreaUnited States
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 192.3.239.164 | compromise (IoCs):- Type Indicator Description IPv4 address 192.3.239.164 U.S.-located attacker server from which researchers collect |
From the original article
6 min read at cybersecuritynews.com
Hackers breached two major South Korean churches, exposing more than one million congregant records and extensive financial and administrative data. The investigation reveals how web shells, leaked credentials, and weak access controls opened routes into connected systems. In one case, attackers entered through a web shell planted in an enterprise resource planning, or ERP, system.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.