Breaches and incidents
Yoido Full Gospel Church and SaRang Church (Seoul): member data found on attacker’s overseas server
Yoido Full Gospel Church said it identified a dataset with personal information associated with about 850,000 members (The Record).
- Disclosed
- Verification
- Confirmed by two or more outlets
What happened
- Yoido Full Gospel Church said it identified a dataset with personal information associated with about 850,000 members (The Record); Korea Times reports the file held membership change history including names, dates of birth and address changes. Korea JoongAng Daily, citing Oasis Security, reports SaRang Church data on more than 89,000 members and 286 staff.
- Root cause per Oasis Security as reported: attackers used previously leaked passwords and flaws in internal applications in one intrusion and a web shell for admin access in the other (The Record); JoongAng Daily says authentication and authorization vulnerabilities were exploited. The intrusions likely occurred in August.
- No attacker named; Oasis Security cited evidence of AI use, including for vulnerability analysis (The Record).
- KISA notified Yoido, which blocked external access, changed server passwords and is notifying members (Korea Times); SaRang formed an emergency task force and reported to authorities (JoongAng Daily).