Attackers' servers held 960,000 member records from Korea's Yoido Full Gospel Church
Oasis Security says attackers' servers held about 960,000 Yoido Full Gospel Church member records with resident registration numbers. The church is still verifying, but the cache shows how much identity and donation data sits behind one administrator account at a large congregation.
The Investor · Invest desk
What happened
- Oasis also identified about 330,000 records of Yoido member offerings that were logged as stolen in August.
- The same cache held about 68,000 electronic approval documents and 14,706 internal messenger conversations, roughly 47.3 gigabytes in all.
- At Sarang Community Church, names, addresses and phone numbers for about 89,000 members turned up on the attacker's server.
- Sarang's intruder is believed to have entered groupware with credentials obtained in advance, then reached the ERP system through single sign-on.
Why it matters
- What doesn't add up contradiction Defenses tuned to Korea's recent bank attacks may miss this route, because Oasis judges the church methods different and a shared attacker unlikely.
- Who has to decide decision Large institutions running HR, accounting, groupware and databases behind shared logins now have to choose between single sign-on convenience and limiting how far one stolen credential reaches.
- Who's exposed exposure If Yoido confirms the theft, its donors' giving histories sit in outside hands next to their resident registration numbers, a pairing far more sensitive than a contact list.
Next story · Invest · Oct 9
One operator used a free pentest agent and Claude Code to breach as many as nine Korean banksConfirmed4 publishers
Divide one Yoido count by the other and the attacker's server holds roughly one offering record for every three member records, 330,000 against 960,000 [1][16]. That ratio makes Yoido's case a money breach as well as a privacy one. Sarang's files, as Oasis Security describes them, are contact details [2], plus data on 286 staff and officials including the senior pastor [3]. Add the two churches together and the member records total about 1,049,000 [18]. Yoido's figure counts records updated over two years [17], so it need not equal distinct people.
The incidents come as hacking cases mount across Korea, including in the financial sector [14]. On the type of data lost, a national ID number next to a record of money given, the church files look like a bank's. On the attacker and the method, Oasis points away from the banks [12].
Both intrusions reached the enterprise resource planning system, by different doors. At Yoido the web shell went onto the ERP server itself, and Oasis saw signs the attacker then widened access to services tied to other internal systems [8]. At Sarang the route was sideways, from groupware to the ERP through a single sign-on function [9]. Each depended on administrator-level privileges once inside [8][9]. I think the exposure for large donor-funded institutions sits in how those systems are linked, where one admin account or one login reaches the accounting data, and the bank comparison helps only on what was taken.
That view could be wrong in two directions. Yoido's review could shrink the scope. The church told Newsis it is checking the time period and scope involved, and that it is difficult to state anything definitively while the investigation is under way [10]. Or the weak point could sit outside church networks altogether. Oasis raised the possibility that credentials or infrastructure from a breach of a U.S. religious content and streaming service were used. The firm said the evidence so far is not enough to conclude the same party carried out the attacks [13].
Yoido learned of the suspected breach from the Korea Internet & Security Agency [7]. It says it will report to authorities and notify members if a breach is confirmed, and will explain what it has found at its Wednesday service [11]. Sarang has formed an emergency task force and reported the matter to the authorities [4]. Neither church has confirmed how many members were affected. The money-breach thesis fails if Yoido finds the 330,000 offering records logged as stolen in August never left its systems [5].
What to watch
- What Yoido tells members at its Wednesday service, and whether it confirms a count of affected members and offering records.
- Whether investigators tie the churches' intrusions to credentials from the breached U.S. religious content and streaming service.
- Whether other Korean religious institutions find their data on the same attacker servers Oasis analyzed.
Information, not investment advice. This story is general information about companies and markets, drawn from cited reporting. It is not a recommendation to buy, sell or hold any security; check the cited sources before acting.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+30
- Incentives35
- Confidence60
Perspective Coverage
3 publishers- Builder
- Builder 33%
- Operator
- Operator 55%
- Investor
- Investor 12%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Cyber threat intelligence firm Oasis Security said on the 6th that it found large volumes of data apparently linked to two major Korean religious institutions while analyzing servers used by overseas attackers.
- [2]
Personal information on about 89,000 Sarang Community Church members, including names, addresses and phone numbers, was found on the attacker's server.
- [3]
Data on 286 Sarang staff and officials, including the senior pastor, was also found on the attacker's server.
- [4]
Sarang Community Church set up an emergency task force and reported the matter to the authorities after identifying signs of a possible data breach.
- [5]
Oasis Security identified about 330,000 records of Yoido member offerings logged as having been stolen in August.
- [6]
The Yoido data included about 68,000 electronic approval documents and 14,706 internal messenger conversations; total volume about 47.3 gigabytes.
- [7]
Yoido Full Gospel Church said it had been notified by the Korea Internet & Security Agency of suspected signs of a personal data breach.
- [8]
The Yoido attacker is believed to have used a web shell to penetrate the church's ERP server, then obtained database administrator privileges, with indications of expanded access to services connected to other internal systems.
- [9]
The Sarang attacker is believed to have accessed groupware using credentials obtained in advance, exploited vulnerabilities to gain administrator-level privileges, and reached the ERP system through a single sign-on function.
- [10]
Yoido Full Gospel Church told Newsis it is checking the facts regarding the specific time period and scope involved, and that it is difficult to state anything definitively while the investigation is under way.
- [11]
If a breach is confirmed, Yoido plans to report it to authorities and notify affected members, and intends to explain what it has learned at its Wednesday service.
- [12]
The methods differ from those used in recent cyberattacks on the financial sector, making it unlikely the same attacker was involved.
- [13]
Oasis Security raised the possibility that credentials or infrastructure obtained in a breach of a U.S. religious content and streaming service were used, but said the evidence so far is not enough to conclude the attacks were carried out by the same party.
- [14]
The suspected church breaches come as hacking incidents mount across South Korea, including in the financial sector.
- [15]
Oasis Security told Yonhap that organizations need to examine how core business systems such as HR and accounting platforms, groupware and databases are connected, as well as their authentication and access control structures.
- [16]
Yoido's cache holds about one offering record for every three member records.
- [17]
From Yoido Full Gospel Church's integrated information system, the firm identified roughly 960,000 member records updated over the past two years, including names and resident registration numbers.
- [18]
Member records found across both churches total about 1,049,000.
Sources
3 independent publishers whose own reporting we read for this story.
- decrypt.coHackers Used AI Agents to Raid a Megachurch's Database, Exposing 850,000 Members
1 article · October 7, 2026
- en.sedaily.comHackers Hit Two of Korea's Largest Churches; 960,000 Records Exposed at One, 89,000 at Another
1 article · October 6, 2026
- therecord.mediaHackers target two South Korean megachurches, potentially exposing congregant data
1 article · October 8, 2026
Topics and entities
Entities
- Oasis Security
- Shinhan Bank
- Sarang Community Church
- Yoido Full Gospel Church
- Lee Jae-myung