Suspected AI-assisted cyberattacks on South Korean megachurches Yoido Full Gospel and SaRang may have exposed member data
Two Seoul megachurches, Yoido Full Gospel Church and SaRang Church, are investigating suspected cyberattacks that may have exposed congregants' personal data. Cybersecurity firm Oasis Security found attack records on an overseas server with signs AI tools were used, including references to "sub-agents" and attack reports that appeared automated. Yoido Full Gospel Church said initial analysis indicated data relating to 850,000 members may have been compromised. Oasis said attackers exploited a flaw in a church membership system that could have allowed access to data linked to up to 89,580 registered user accounts. Yoido Full Gospel Church said it was notifying affected members, blocking external access and changing server passwords. SaRang Church said it had formed an emergency task force and reported the suspected incident to authorities. The news follows hacking attacks on South Korean banks in which AI was believed to have been used.
What the AI did
Attackers are suspected of using AI tools to carry out the intrusions: attack records found on an overseas server referred to "sub-agents" (AI programs handing off tasks to other AI programs) and contained extensive attack reports that appeared automated. It has not been reported which AI tool was used.
First reported October 7, 2026 · Added to the register October 11, 2026 · 1 source
- Yoido members whose data may be compromised
- 850,000
- Affected
- Yoido Full Gospel Church, SaRang Church
- Country
- South Korea
- When it happened
- Not stated in the sources
- First reported
- October 7, 2026
What this means for you
Could this affect you?
If you are a member of Yoido Full Gospel Church or SaRang Church. Yoido Full Gospel Church said data on 850,000 members may have been compromised, including names and dates of birth, and for a smaller number of members national ID numbers, addresses and phone numbers. Oasis Security said a flaw in a church membership system could have allowed access to data linked to up to 89,580 accounts. SaRang Church has reported the suspected incident to authorities.
What to check
- Patch and test membership or customer portals for flaws.
- Restrict external access to those systems.
- Rotate server credentials and passwords.
- Monitor for automated, agent-driven intrusion patterns.
Areas of your AI programme this touches
Every fact and its source (4)
- SaRang accounts potentially accessible via flawUp to 89,580 accounts“access to data linked to up to 89,580 registered user accounts”[1]
- Signs of AI useReferences to sub-agents and automated-looking attack reports“such as references to “sub-agents” and extensive attack reports that appeared automated”[1]
- Firm that found attack recordsOasis Security“Cybersecurity company Oasis Security found data, attack records and account information on an overseas server”[1]
- ResponseNotifying members, blocking access, changing passwords“The church said it was notifying affected members, blocking external access and changing server passwords.”[1]
Sources
- South Korean churches probe suspected AI cyberattackscyprus-mail.com · October 7, 2026
How this record is classified. Severity S (4/5): real harm to one organisation, data exposed, or a containment failure. OECD level: incident, an event in which an AI system led to actual harm. Evidence: Reported, meaning press reporting only.
The facts in At a glance and in Every fact and its source are quoted from the sources listed. The summary, What the AI did and What this means for you are written from those sources and checked against them automatically before publication. Records reflect what has been disclosed, not everything that has happened. Incidents are found through news feeds and the GDELT Project.
