Two South Korean megachurches investigate reported data breaches

Oasis and later church reporting describe breaches at two South Korean megachurches, with conflicting counts of exposed member records.

Oasis Security reported that attackers breached two of South Korea’s largest churches, initially left unnamed. At the first, a web shell in an ERP system led to Microsoft SQL Server administrator access, with about 960,000 congregant records, about 330,000 donation records, and 47.3 GB across 13,939 files staged in a MinIO bucket. The second intrusion used leaked groupware credentials and IDOR flaws to expose about 89,000 congregant records and 286 employee records and to reach SAP through single sign-on. One outlet said tooling and stolen files were recovered from U.S. server 192.3.239.164 between August 28 and September 1, 2026, that the web shell was still internet-accessible on September 9, and that the recovered volume is a lower bound while unique-person totals are unverified. The Record later named Yoido Full Gospel Church and SaRang Church as investigating and said Yoido identified personal information for about 850,000 members, which disagrees with Oasis’s roughly 960,000 figure for the larger intrusion, while restating Oasis’s about 89,000-member and 286-employee figures for a second intrusion. It also said the activity likely occurred in August, reused infrastructure from an earlier compromise of a U.S.-based Christian content platform, and that researchers said the attackers used AI; sources still disagree on whether combined exposure exceeds one million unique people.