Yoido Full Gospel Church in Seoul said on Oct. 7, 2026, that its initial analysis indicates that attackers may have compromised data tied to 850,000 members, according to Seoul Economic Daily. That is the church’s own preliminary estimate. Security firm Oasis Security counted about 960,000 congregant records recovered from the larger victim and about 1.05 million records across both victims, Cyber Press reported.
Sarang Church, also in Seoul, is investigating a suspected cyberattack of its own, The Record reported. The church has not disclosed the number of affected people, and The Record’s account does not include any confirmation from Sarang that attackers exposed data.
How the incidents came to light
Oasis Security found attack records, account information and congregant data tied to both churches on an attacker-controlled server located overseas, The Record reported. The firm said the intrusions likely occurred in August.
Yoido Full Gospel Church said the Korea Internet & Security Agency (KISA) notified it of signs of a breach. The Korea Times dates that notice to the afternoon of Tuesday, Oct. 6, and the church gave its 850,000 estimate the next day.
Oasis Security’s analysis of the server covered files collected between Aug. 28 and Sept. 1, 2026, and the web shell, a malicious script that gives remote control of a server, still remained reachable on Sept. 9, Cyber Press reported.
What Yoido Full Gospel Church says was affected
Seoul Economic Daily reported that the church traced the 850,000 figure to one file that records changes to congregant information. The church said the other six of seven suspect files held no personal data.
The church said that file included 2,629 changes to resident registration numbers, 3,964 to phone numbers and 7,202 to addresses, according to The Korea Times.
I feel a deep sense of responsibility for causing concern among our members as a result of this incident, and I sincerely apologize
Lee Young-hoon, The Korea Times
What Oasis Security reports about the two intrusions
In the larger intrusion, Oasis Security said attackers used a web shell in the ERP application, the software that runs administration and accounting, to gain administrator-level database access, according to The Record. Researchers recovered 47.3 GB across 13,939 files, which Cyber Press described as a lower bound. The material included about 330,000 donation records, 68,000 approval documents, payroll, accounting and internal communications.
The second intrusion used leaked credentials and insecure direct object reference flaws, which let a user reach records by altering an identifier in a request, according to The Record. Attackers then reached SAP through single sign-on, and the intrusion exposed about 89,000 member records and 286 employee records.
Oasis Security did not name the churches. Jaekyung Ilbo’s report on the 89,000-record victim points to Sarang Church, but that is a media report rather than a confirmation from the church.
Sarang Church said it set up an emergency task force, notified authorities and is working to establish what happened, according to The Record.
Why it matters
The incidents follow hacks of South Korean commercial banks. Fox Business reported that President Lee Jae Myung said on Oct. 6 that officials believed AI had been used in those attacks.
In the church cases, Oasis Security assessed that attackers used AI tools, citing references to sub-agents and extensive reports that appeared automated, The Business Standard reported. The Record reported that the attackers reused infrastructure, including storage credentials, from an earlier compromise of an unnamed US-based Christian content platform. Researchers did not identify the attackers, their nationality or their motive.
What affected members can expect
Yoido Full Gospel Church said the church is notifying affected members, according to The Korea Times. The fields in the file the church cited are resident registration numbers, phone numbers and addresses.
The church said it deleted malicious files, blocked external access and changed server and account passwords. It also plans to replace its firewall and run a vulnerability analysis, according to The Korea Times. The sources reviewed do not describe any guidance the church has published for members, and Sarang Church has not said whether it will notify anyone.
Join the discussion