Loading story…
Seoul’s Yoido Full Gospel Church and SaRang Church are investigating suspected cyberattacks that may have exposed congregants’ personal information. Yoido said initial analysis indicated that data associated with approximately 850,000 members may have been compromised, including names and dates of birth, with a smaller number of records containing national identification numbers, addresses and telephone numbers. Oasis Security also reported a membership-system flaw that could have exposed data associated with up to 89,580 SaRang accounts. The full scope of any exposure remains unconfirmed.
Oasis Security discovered church-linked data, attack records and account information on an overseas server. References to “sub-agents” and apparently automated reports suggest possible AI use during the intrusions, but investigators have not confirmed that involvement. Yoido is notifying affected members, restricting external access and changing server passwords; SaRang has established an emergency task force and reported the incident to authorities. The potentially exposed identity and contact information raises risks of targeted phishing and identity fraud for affected congregants.
See attribution, scope, and your downstream exposure.
9 events from the most recent confirmed update back to the earliest known activity.
Yoido Full Gospel Church said an initial analysis indicated that data associated with approximately 850,000 members may have been compromised. Potentially exposed information included names and dates of birth, with a smaller number of records containing national identification numbers, addresses and telephone numbers.
South Korean President Lee Jae Myung said signs of artificial intelligence use had emerged in recent hacking incidents involving banks.
Oasis Security found that the church attackers reused infrastructure associated with an earlier compromise of an unnamed U.S.-based Christian content platform, suggesting a technical connection between the incidents. Researchers did not establish the attackers’ identities, nationality or motives.
OASIS reconstructed two South Korean church intrusions involving an ERP web shell, database command execution, leaked credentials and IDOR weaknesses, and recovered 47.3 GB of staged data. The evidence included approximately 960,000 congregant records from one church and 89,000 from the other, alongside financial, personnel and administrative data; unique-person totals remained unverified.
SaRang Church formed an emergency task force and reported the suspected breach to relevant authorities. It said it was investigating the incident and taking measures to prevent further harm.
Yoido Full Gospel Church said it blocked external access, changed server passwords and was notifying affected members in response to the suspected compromise.
Oasis Security said attackers exploited a flaw in SaRang Church’s membership system that could have allowed access to data linked to up to 89,580 registered user accounts. The full extent of the suspected exposure remained under investigation.
Oasis Security found data, attack records and account information linked to Yoido Full Gospel Church and SaRang Church on an overseas server. References to “sub-agents” and apparently automated attack reports suggested possible AI involvement, which remained unconfirmed.
Hacking attacks against South Korean commercial banks exposed customers’ personal information. The reports describe these attacks as preceding the suspected church intrusions.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
6 references tracked. Mallory keeps watching after this page renders.
therecord.media
Open sourcecybersecuritynews.com
Open sourcejustsecurity.org
Open sourceteiss.co.uk
Open sourcefoxbusiness.com
Open sourceoasis-security.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
South Korean President Lee Jae Myung ordered a thorough investigation into recent data breaches at financial and public institutions after receiving a briefing on the incidents and their responses. The Financial Services Commission held an emergency meeting, confirming a data compromise at Shinhan Bank and incidents affecting other banks, including KB Kookmin Bank. Local media reported exposure of data belonging to 25,000 Shinhan customers and credit card information belonging to 119,000 Kookmin customers, while Hana Bank reportedly suffered a limited breach of its sales support system. Authorities launched on-site investigations and ordered financial companies to review externally accessible systems, authentication, access controls, and unnecessary information exposure, alongside coordinated threat-information sharing. Yonhap reported that a server used in the attacks had an HTML page title containing Chinese-language text associated with ARTEX AI, an open-source, AI-agent-based penetration-testing system. **Neither the banks nor financial authorities have confirmed AI involvement**, and the Chinese-language text does not establish attribution to any particular threat actor.
Oct 7, 2026
Coupang, South Korea's largest e-commerce platform, confirmed a major data breach that exposed the personal information of approximately 33.7 million customers, representing a significant portion of the country's population. The breach, which was initially detected on November 18 with only 4,500 accounts affected, was later found to be far more extensive, involving names, email addresses, phone numbers, shipping addresses, and partial order histories. Coupang stated that payment card details and login credentials were not compromised. The unauthorized access reportedly began on June 24, originating from overseas servers, and was facilitated by weaknesses in Coupang's authentication key management, including the failure to rotate or revoke signing keys after responsible employees left the company. South Korean authorities, including the National Police Agency, Korea Internet & Security Agency, and the Personal Information Protection Commission, have launched investigations into the incident, focusing on Coupang's compliance with data protection obligations. The government convened an emergency meeting and announced plans for stricter oversight and potential sanctions if safety measure violations are confirmed. Coupang has since blocked the unauthorized access route, enhanced internal monitoring, and engaged external security experts. The company issued public apologies and is cooperating with authorities to prevent further harm, while also notifying affected customers and providing support channels for inquiries.
Jun 29, 2026
Sakura Internet disclosed that attackers accessed its sales management system, potentially exposing customer contract and membership information tied to as many as **1,360,563** member accounts. The intrusion was uncovered during an investigation into a separate breach affecting the **Sakura Rental Server** service, where **583 accounts** experienced unauthorized logins and malware was found on Sakura systems. The company said the exact number of affected accounts is still under investigation and that it has not confirmed any data exfiltration. Sakura said passwords in the affected system were stored in hashed form and that the compromised environment did **not** contain credit card data. The company also stated the incident was **not ransomware-related**, no ransom demand was received, and no operational disruption was reported. Sakura invalidated abused credentials, removed detected malware, and notified affected customers and relevant authorities as the investigation continues.
Aug 21, 2026