Two Seoul megachurches investigate a breach that may have exposed data on 850,000 members, and the firm that found it says the records show signs of AI tools

Two of Seoul's largest churches, Yoido Full Gospel Church and Sarang Church, are investigating suspected cyberattacks, Reuters reported on 7 October. The security firm Oasis Security found data, attack records and account information linked to both churches on an overseas server. Reuters reports that the records included signs that AI tools were used during the intrusion, “such as references to “sub-agents” and extensive attack reports that appeared automated, Oasis Security said.”

Yoido Full Gospel Church said its initial analysis indicated that data relating to 850,000 members may have been compromised, including names and dates of birth. Sarang Church said it had formed an emergency task force and reported the incident to the authorities.

Oasis Security's own report, dated 6 October, does not name the victims. It describes a web shell planted on the first victim's ERP system, administrator rights on four databases, a database monitoring tool bypassed, and 47.3 GB (13,939 files) recovered, which it calls a lower bound, collected between 28 August and 1 September. It counts approximately 960,000 congregant records at the first victim, more than the church's own figure, and approximately 89,000 congregants and 286 HR records at the second. It says the same operator had previously targeted a US Christian content platform.

The report itself names no AI model or tool and does not use the word “sub-agent”. Its only AI sentence is general: “By using AI, attackers can rapidly carry out lateral movement, reverse engineering, vulnerability analysis, and data exfiltration.” What is new since yesterday's story on South Korea's bank hacks: suspected AI-assisted intrusions have now been reported outside the banks, with a forensic report behind them.

• Reported Yoido Full Gospel Church said initial analysis indicated data relating to 850,000 members may have been compromised; Sarang Church formed an emergency task force. Reuters (via The Standard)
• Reported Oasis Security told Reuters the attack records showed signs of AI tools, such as references to sub-agents and automated-looking attack reports. Reuters (via Internazionale)
• Claimed Oasis counts approximately 960,000 congregant records at one victim and approximately 89,000 at the other, with 47.3 GB (13,939 files) recovered. Oasis Security
• Confirmed Oasis's English report names no AI model or tool and does not contain the word sub-agent. Oasis Security