South Korea Megachurch Hack Hits 850,000 Members [2026]

Two of South Korea’s largest churches are investigating suspected cyberattacks that may have exposed personal data belonging to hundreds of thousands of congregants, with early technical signs pointing to attacker activity automated by artificial intelligence. Yoido Full Gospel Church in Seoul, described in multiple reports as the country’s largest registered congregation, said on October 7, 2026, that an initial review found data tied to roughly 850,000 members may have been compromised. Sarang Church, also in Seoul, surfaced in the same investigation after a cybersecurity firm found related data sitting on an overseas server.

Reuters summarized the situation plainly: “Two South Korean megachurches are investigating suspected cyberattacks that may have exposed the personal data of hundreds of thousands of congregants, with evidence suggesting AI tools may have been used in the attacks,” the news organization reported. The disclosure lands just three days after South Korean President Lee Jae Myung said AI appeared to have played a role in recent cyberattacks hitting the country, a comment made October 6 as authorities were still working out exactly how.

Which churches were hit, and how many people are affected

Yoido Full Gospel Church sits at the center of the story. Membership estimates for the congregation vary depending on how historical and affiliated records are counted, but reporting consistently places it among South Korea’s largest single churches. The church itself set the scale of the incident on October 7, saying in a statement that “initial analysis indicated data relating to 850,000 members may have been compromised,” per coverage from the Economic Times.

Other outlets cited a slightly different figure: roughly 960,000 Yoido member records, reflecting updates made over the prior two years, turned up in the exposed material. Separately, about 330,000 donation or offering records tied to Yoido were reportedly identified as stolen in August 2026. A third figure, closer to 96,000 records, described a narrower dataset containing names, addresses, and phone numbers updated during the previous two years. These numbers measure different things, members, records, and donation entries, so they should not be summed into one total.

Sarang Church’s exposure looks smaller in raw numbers but cuts deeper into the institution’s internal structure. Reports put the affected member count at roughly 89,000, alongside records for 286 employees and officials, including the senior pastor. The south korea megachurch cyberattack investigation into Sarang reportedly involves stolen login credentials that were used to move from one system into other internal networks, a detail that distinguishes it from the more database-centered exposure at Yoido.

What data was taken from Yoido and Sarang

The categories of exposed information span years of church record-keeping. For Yoido, the material reportedly includes names, home or mailing addresses, telephone numbers, membership status, and donation or tithing history. Some of that giving data reportedly dates back to 1993 and runs through 2019, meaning the exposed dataset blends decades-old archival records with information updated as recently as the past two years.

At Sarang, the data trail reportedly includes personnel and official records tied to 286 staff members, plus information connected to the senior pastor, accounting data, and internal administrative documents. Investigators said stolen credentials appeared to be the entry point, which then let whoever was behind the intrusion reach additional internal systems beyond the original point of access.

Inside the suspected intrusion: admin access and stolen credentials

The technical picture, as described by the security firm Oasis Security, splits into two distinct intrusion styles. At Yoido, the firm assessed that an attacker obtained administrator-level access to the church’s database, a level of privilege that typically allows bulk extraction of records without needing to touch individual user accounts one at a time. At Sarang, the pattern looked different: stolen credentials, rather than a direct administrative compromise, served as the key that let the intruder into the network and from there into connected internal systems.

Oasis Security said it located data tied to both churches sitting on a server controlled by an overseas hacker, which is how the scope of the incident first came into focus. No hacker group or nation-state has been publicly confirmed as responsible for either breach. That attribution gap matters because it separates two things reporters and officials have sometimes blurred together: evidence that a tool originated somewhere, and proof that a specific actor used it against these specific targets.

Why investigators suspect AI tools were used

The AI angle is what pushed this story past a routine data-breach disclosure. Oasis Security pointed to specific technical fingerprints in the attack records. “Records of the alleged attacks included signs that AI tools were used during the intrusion, such as references to ‘sub-agents’ and extensive attack reports that appeared automated,” the firm said, according to the Economic Times.

References to “sub-agents” suggest a multi-step automated workflow rather than a single hacker manually clicking through a database one record at a time. Extensive, automatically generated attack reports point the same direction: a human operator reviewing logs line by line would not typically produce that volume of documentation on their own. President Lee’s October 6 remarks, made before either church went public, line up with what investigators found days later, though officials have been careful to say they have not yet determined precisely how AI was used or by whom.

Breach by the numbers: Yoido vs. Sarang

Detail	Yoido Full Gospel Church	Sarang Church
Members potentially affected	Approximately 850,000 (church’s own figure)	Approximately 89,000
Alternate record count cited	Approximately 960,000 member records	286 employees and officials
Donation/financial records	Approximately 330,000, dated 1993-2019	Not separately specified in reporting
Senior leadership data involved	Not specified	Yes, including the senior pastor
Reported access method	Administrator-level database access	Stolen credentials used to reach internal networks
Where data surfaced	Overseas hacker-controlled server	Same or related overseas server

Reading the two incidents side by side shows why investigators have not simply treated this as one breach with two victims. The entry points differ, the data categories differ, and the raw scale differs by an order of magnitude. What connects them is the overseas server where Oasis Security found both datasets, and the broader suspicion that automated tooling sped up the intrusion.

Timeline: how the disclosure unfolded

Date	Development
August 2026	Suspected theft of Yoido donation records and Sarang personnel/member data reportedly occurs
October 6, 2026	President Lee Jae Myung says AI appeared to be involved in recent cyberattacks hitting South Korea
October 7, 2026	Yoido Full Gospel Church announces initial analysis points to roughly 850,000 members potentially affected
October 7-8, 2026	Sarang Church identified as a second affected institution; Oasis Security details findings
October 8-9, 2026	Coverage links the church incidents to South Korea’s wider 2026 cybersecurity wave, including bank breaches and a Korea Electric Power Corp. incident

Official responses from the churches and Seoul

Yoido’s public account of its own response describes a rapid internal process triggered by an outside tip. “Immediately after being notified by the Korea Internet & Security Agency (KISA) at 3:00 p.m. yesterday of a suspected security breach in the church’s information system, we launched an emergency security check and analyzed suspected leak data and system access logs with an external security specialist organization,” the church said, according to SBS News. That detail is notable on its own: the church learned about the intrusion from South Korea’s national cybersecurity agency rather than detecting it through its own monitoring.

A church representative identified in reporting only as “Lee” offered a personal apology to the congregation. “I feel a deep sense of responsibility for causing concern among our members as a result of this incident, and I sincerely apologize,” the representative said, per the Korea Times. Sarang Church has acknowledged it is investigating a suspected attack, though available reporting does not include a detailed public statement from Sarang comparable to Yoido’s. On the government side, South Korean officials have called for stronger cybersecurity safeguards following a string of breaches at major financial institutions earlier in 2026, and have not confirmed whether a single actor is behind the bank, power-company, and church incidents.

The ARTEX connection and the rise of autonomous hacking agents

One detail from the parallel bank-hacking investigation has drawn particular attention: logs from breached financial institutions reportedly contained traces of ARTEX, an open-source autonomous penetration-testing agent built by a developer in China. That finding comes from the bank-side probe, not the church investigation, and reporting has been explicit that it does not establish ARTEX was used against either Yoido or Sarang. It also does not prove Chinese state involvement. A tool’s country of origin says something about where code was written, not who deployed it or why.

Still, the presence of a named autonomous pentesting agent in one part of South Korea’s 2026 hacking wave, combined with Oasis Security’s “sub-agent” findings in the church breach, points to a pattern worth watching. Security teams built these dual-use testing tools to find vulnerabilities before attackers do. When the same category of tooling shows up on the offensive side of multiple, unrelated incidents in the same country within weeks of each other, it suggests the barrier to running a multi-stage, semi-automated intrusion has dropped. Readers who want the fuller picture of that earlier investigation can check our coverage of how CrowdStrike tied an AI agent to a China-linked actor in the banking breaches, and our report on South Korea’s probe into AI’s role in those earlier bank hacks.

How the church breaches compare to South Korea’s bank hacks

South Korea has had a rough 2026 on the cybersecurity front, and the church incidents are the latest entry rather than an isolated event. Financial institutions were hit earlier in the year in a wave serious enough that regulators ordered security checks across the sector after four separate breaches, a response we detailed in our report on Korea’s financial-sector security order. Hyundai Capital also disclosed a hack affecting data tied to 146 loan agents, covered in our story on the Hyundai Capital breach.

The contrast between these targets is instructive. Banks hold financial and credit information protected by sector-specific regulation and, generally, better-funded security teams. Churches hold membership rolls, donation histories, and personnel files, often managed with far thinner IT budgets and no equivalent regulatory floor. Yoido’s own account of learning about its breach from KISA, rather than from internal detection, underscores that gap. If automated, AI-assisted attack tooling is becoming cheap and repeatable enough to run against both a national bank and a congregation’s membership database within the same few months, soft targets with weaker defenses look like the next logical pressure point.

Market impact: cyber insurance, identity monitoring, and AI governance

Religious and nonprofit institutions are not public companies, so there is no stock price to move on this news. The market impact instead shows up in three adjacent industries. Cyber insurance underwriters who price policies for nonprofits and religious organizations now have a concrete loss event involving donation records spanning decades, a category of exposure many policies were not written to anticipate. Identity-monitoring and breach-notification vendors gain a fresh case study in long-tail data, since donation records dating to 1993 sat exposed alongside information updated within the last two years.

The third and arguably largest effect lands on AI governance policy. South Korea’s government was already under pressure after the earlier bank breaches, and a second wave of AI-linked intrusions within the same year strengthens the case for mandatory AI-usage disclosure in security incident reporting. Enterprises evaluating their own exposure increasingly weigh identity and access tooling against this kind of scenario, and firms like Oracle have faced their own large-scale exposure events this year, as covered in our piece on the Oracle Health breach affecting nearly 20 million people, giving regulators more comparative data points to work from when drafting rules.

What security experts are saying

Oasis Security’s technical read is the clearest expert voice in this story so far, and it centers on automation signatures rather than attribution. The firm’s reference to “sub-agents” in the attack records implies a structured, task-delegating system, the kind of architecture associated with modern AI agent frameworks rather than a single script running start to finish. That is a meaningfully different threat model than a lone intruder manually querying a database, because it suggests the attacker’s tooling could, in principle, be pointed at a different target with modest reconfiguration.

Government-level reaction has been more cautious. President Lee’s October 6 comment that AI “appeared” to be involved, without specifying how, reflects an investigation still in progress rather than a closed case. That caution is appropriate given how often early breach attribution gets revised once forensic teams complete a full log review, and it is a reminder that headlines citing specific hacker groups or nation-states in this story should be treated skeptically until officials confirm them on the record.

Five predictions for what happens next

More South Korean institutions will disclose similar incidents. Once KISA and private firms like Oasis Security start actively hunting for exposed data tied to the same overseas infrastructure, additional victims tend to surface within weeks, not months.
Attribution will stay unresolved for some time. Neither a hacker group nor a nation-state has been named in the church breach, and the ARTEX trace found in the separate bank investigation has not been linked to these incidents, so expect continued caution from officials rather than a quick naming of a culprit.
South Korea will tighten disclosure rules for AI-assisted attacks. With two major incident clusters in one year both carrying AI fingerprints, pressure will build on regulators to require organizations to report whether forensic evidence points to automated or agentic tooling.
Religious and nonprofit organizations will face new scrutiny over IT budgets. Expect denominational bodies and nonprofit associations in South Korea and beyond to push members toward baseline security audits, mirroring the sector-wide checks already ordered for banks.
Dual-use security tools like ARTEX will draw export and ethics debate. An open-source autonomous pentesting agent showing up in real breach logs, even without confirmed misuse, will sharpen calls for guardrails on publicly released offensive-security automation.

Defensive takeaways for nonprofits and religious institutions

The practical lesson from Yoido and Sarang is not exotic. Both incidents trace back to familiar root causes, administrator-level access that was not sufficiently restricted and credentials that were reused or inadequately protected, amplified by tooling fast enough to pull hundreds of thousands of records before anyone noticed. Smaller organizations without dedicated security teams often assume they are too small to attract this kind of attention. A congregation’s membership and donation database, built up over decades, turns out to be exactly the kind of long-tail, rarely-audited dataset that automated tools are good at finding.

Concrete steps that apply well beyond churches include enforcing least-privilege access on donor and membership databases, rotating and monitoring credentials used by staff and volunteers, and establishing a relationship with a national or regional cybersecurity agency before an incident happens rather than after. Yoido’s statement credits KISA’s 3:00 p.m. notification as the trigger for its emergency response, which means the church itself did not detect the intrusion internally. Building that detection capability in-house, even at modest scale, remains the single biggest gap separating organizations that catch a breach early from those that learn about it from a government phone call.

Frequently Asked Questions

How many people were affected by the South Korea megachurch cyberattack?

Yoido Full Gospel Church said initial analysis pointed to roughly 850,000 members potentially affected, while other reporting cited approximately 960,000 member records and 330,000 donation records. Sarang Church’s exposure covers approximately 89,000 members and 286 employees and officials. These figures measure different datasets and should not be added together as one total.

Which churches are investigating the breach?

Yoido Full Gospel Church and Sarang Church, both located in Seoul, are the two institutions named in current reporting on this incident.

Was AI actually used in the attack?

Investigators have not confirmed exactly how AI was used. Oasis Security found technical signs, including references to “sub-agents” and automatically generated attack reports, that suggest automated tooling played a role. President Lee Jae Myung said AI appeared to be involved in the broader wave of 2026 South Korean cyberattacks, but officials have stopped short of a definitive technical conclusion for the church breach specifically.

Who is responsible for the attack?

No hacker group or nation-state has been publicly confirmed as responsible. Oasis Security found church data on an overseas hacker-controlled server, but attribution to a specific group remains unresolved in current reporting.

Is this connected to the South Korea bank hacks earlier in 2026?

A direct operational link has not been proven. The connection is based on timing, the possible use of AI tooling in both cases, and a general pattern of South Korean institutions facing automated intrusions in 2026. The bank investigation reportedly found traces of ARTEX, an autonomous penetration-testing agent, in its logs, but that tool has not been tied to the church incidents.

What data was stolen from the churches?

Reported data includes names, addresses, phone numbers, membership status, donation and tithing history dating back to 1993, employee and official records, and information tied to Sarang’s senior pastor. Sarang’s incident also reportedly involved stolen login credentials used to access internal networks.

How did the churches find out about the breach?

Yoido said it was notified by the Korea Internet & Security Agency (KISA) at 3:00 p.m. on the day before its public statement, which triggered an emergency internal security check conducted with an outside security specialist firm.

What should other organizations do in response to this news?

Security specialists point to least-privilege access controls on membership and donor databases, credential rotation and monitoring for staff and volunteer accounts, and establishing a working relationship with a national cybersecurity agency ahead of any incident as the most direct steps nonprofits and religious institutions can take.