South Korea’s cyberattack investigation into the country’s megachurches widened dramatically this week after a second Seoul congregation, Sarang Community Church, confirmed that member records had been stolen, just days after Yoido Full Gospel Church disclosed a breach now estimated to touch as many as 960,000 people. President Lee Jae Myung has ordered government agencies to pour resources into the response, and Reuters reported that cybersecurity analysts found signs an AI tool may have been used in the intrusion. No suspect, hacking group, or arrest has been publicly named as of October 9, 2026.
The case has moved fast and gotten messier with each new data point. Figures reported by South Korean outlets for the Yoido breach alone have ranged from 850,000 to 960,000 affected members, plus a separate server reportedly holding roughly 330,000 donation records. Those numbers are not necessarily additive, and investigators have not confirmed a single final victim count. What is clear is that two of Seoul’s largest Protestant congregations are now at the center of a cybersecurity story that has pulled in the Korea Internet & Security Agency (KISA), the presidential office, and a national conversation about whether AI tools are lowering the bar for large-scale data theft.
How the Yoido Full Gospel Church breach surfaced
According to SBS News and the Seoul Economic Daily, KISA notified Yoido Full Gospel Church at around 3:00 p.m. on October 6, 2026, after detecting indications that the church’s information systems had been compromised. The church said it immediately launched an emergency security review, working with an outside cybersecurity firm to analyze suspected leaked files and examine system-access logs. In a statement reported by Asia Economic Daily, the church described the sequence directly: “Upon being notified by the Korea Internet & Security Agency (KISA) at 3:00 p.m. the day before about indications of a breach of the church’s information systems, we immediately initiated an emergency security inspection and, together with an external security firm, analyzed the potentially leaked materials and system access logs,” according to Asia Economic Daily.
The church’s public posture has leaned toward cooperation rather than denial. In a separate statement carried by Maeil Business Newspaper, the church said: “We have recently been informed of the suspected leakage of personal information by KISA and will actively cooperate with the investigation and confirmation process of related agencies,” according to Maeil Business Newspaper. The same statement added a note of contrition: “We are seriously aware of this issue and will do our best to prevent the same from happening again by supplementing the entire information protection system.”
Yoido is one of the largest single congregations in the world, and the scale of its membership database is part of why the numbers involved have swung so widely across different reports. SBS News and the Seoul Economic Daily reported that modification logs inside the compromised systems included 2,629 records involving changes to resident-registration numbers, 3,964 phone-number changes, and 7,202 address changes. Those figures describe how many records were altered over time, not necessarily how many individuals had their underlying identification data exposed in the breach itself, a distinction that has fueled confusion in early coverage.
Why the victim count keeps changing
Three different numbers have circulated for the Yoido incident alone: 850,000, 960,000, and roughly 330,000. Reuters and SBS News reported the 850,000 figure as the church’s own early estimate of members whose information may have been leaked, covering names, dates of birth, and records of personal-information changes. Separately, SBS News reported that other analysis pointed to information on as many as 960,000 Yoido members, including names, addresses, and phone numbers updated over the prior two years, alongside donation and tithing records dating back as far as 1993 through 2019.
A third figure comes from a different angle entirely. Korea JoongAng Daily reported that a server containing approximately 330,000 donation records tied to Yoido appeared to have been stolen in August 2026, weeks before KISA’s October notification. That timeline detail matters: if the theft happened in August and the church was only alerted in October, the intrusion sat undetected for roughly two months, a gap that cybersecurity teams typically flag as a sign of weak log monitoring or an attacker who deliberately stayed quiet to avoid triggering alerts.
Reuters, Korea JoongAng Daily, and SBS News have each cautioned that these figures likely represent different datasets, different stages of forensic analysis, or overlapping records counted in different ways, rather than a single confirmed total. That is a familiar pattern in early-stage breach disclosures: initial estimates based on what a compromised server appears to contain are almost always revised, sometimes upward and sometimes downward, once forensic firms finish a full audit trail. See the Korea JoongAng Daily report for the fullest breakdown of the competing figures.
Sarang Community Church becomes the second confirmed victim
Fox Business and Reuters both named Sarang Community Church, also known as SaRang Church, as the second major Seoul megachurch swept into the data-theft investigation. SBS News reported that files tied to Sarang contained personal information on more than 89,000 members, including names, addresses, and telephone numbers. The exposure was not limited to ordinary congregants: SBS News also reported that the Sarang data included information on 286 employees and officials, including the church’s senior pastor.
According to the same SBS News reporting, the Sarang records were, like the Yoido data, apparently stolen in August 2026, which lines up the two incidents on a similar timeline even though the churches disclosed them separately and days apart. Sarang’s own public response has mirrored Yoido’s: the church said it was examining the facts and considering whether to formally report the incident and request an official investigation, while also committing to new security measures aimed at preventing further damage, according to SBS News.
The fact that two of Seoul’s most prominent congregations were hit on a similar timeline, using what appears to be a similar method, is the detail driving investigators toward treating this as a single coordinated campaign against religious institutions rather than two unrelated incidents. Megachurches sit on unusually rich personal-data troves for institutions outside the financial and healthcare sectors: decades of donation records, family relationship data, address histories, and government ID numbers used for tax-deduction receipts on tithes, all stored in systems that typically receive a fraction of the security investment a bank or hospital would budget for equivalent data volumes.
The AI-tool question Reuters raised
The detail most likely to reshape how this story is read in cybersecurity circles is Reuters’ report that evidence suggested artificial-intelligence tools may have been used in the intrusion. That detail was described as an indication drawn from cybersecurity analysis, not proof of who carried out the attack or why. Still, it lands at a moment when South Korean officials are already on edge about AI-assisted hacking. Tech Insider has previously covered a related thread in CrowdStrike’s assessment tying an AI agent to a cluster of South Korean bank hacks, and in the government’s own formal probe into AI use in bank hacking that exposed roughly 68,000 records.
Reports reviewed for this story do not establish an operational or criminal link between the megachurch breaches and the separate, ongoing investigations into South Korea’s banking sector hacks. The two tracks are being described by Korean outlets as parallel concerns rather than confirmed parts of the same campaign. But the pattern across both is consistent: large personal-data stores, breached quietly, discovered weeks or months later, with AI-assisted tooling floated as a possible factor in how quickly or broadly the data could be harvested once access was gained.
President Lee Jae Myung orders a government-wide response
Korea JoongAng Daily and Reuters both reported that President Lee Jae Myung ordered government personnel and resources to be devoted to responding to AI-driven hacking attacks, a directive that followed security researchers surfacing the allegedly stolen Yoido and Sarang records. The order signals that Seoul is treating this less as an isolated incident at two private institutions and more as a symptom of a broader security gap that the state needs to address directly, rather than leaving each breached organization to manage disclosure and remediation on its own.
That instinct tracks with how South Korea has handled a string of other high-profile breaches this year. The government previously ordered banks to run security checks after a string of breaches hit the financial sector, a move Tech Insider covered when Korea ordered bank security checks following four separate incidents. A similar instinct showed up after Hyundai Capital disclosed a hack exposing data tied to 146 loan agents, where regulators pushed for faster disclosure timelines across the lending industry. The megachurch case extends that pattern of state-level intervention into a sector, religious institutions, that has historically operated with far less regulatory oversight of its data-security practices than banks or hospitals.
What KISA’s involvement signals
The Korea Internet & Security Agency is the government body responsible for detecting and responding to cyber incidents affecting Korean networks, and its direct notification to Yoido, rather than the church detecting the breach on its own, is a meaningful detail. It suggests KISA’s monitoring systems picked up on suspicious activity or data exposure before the church’s internal security team did, which points to either a gap in the church’s own detection capability or an intrusion sophisticated enough to evade standard logging for an extended period. Given the Korea JoongAng Daily report that the donation-record server was apparently compromised in August, roughly two months before the October notification, the latter explanation looks more likely.
Heraldcorp’s business desk reported the same sequence in similar terms, describing how the church launched its emergency security review immediately after KISA’s Tuesday afternoon notification, according to The Korea Herald’s business edition. That consistency across multiple Korean outlets, SBS News, Seoul Economic Daily, Asia Economic Daily, Maeil Business Newspaper, and the Korea Herald, all describing the same 3:00 p.m. notification and emergency response, suggests the timeline itself is well-established even while the final victim count remains unsettled.
Scale comparison: the two churches side by side
| Detail | Yoido Full Gospel Church | Sarang Community Church |
|---|---|---|
| Reported affected members | 850,000 (initial) to 960,000 (later analysis) | More than 89,000 |
| Data types reported | Names, dates of birth, addresses, phone numbers, donation/tithing records (1993-2019) | Names, addresses, telephone numbers, plus 286 staff/officials including the senior pastor |
| Separate dataset found | ~330,000 donation records on a separate server | Not separately reported |
| Reported theft window | August 2026 (per Korea JoongAng Daily) | August 2026 (per SBS News) |
| Disclosure trigger | KISA notification, October 6, 2026 | Identified following Yoido disclosure |
| Church’s stated response | Emergency review with outside security firm, system-access log analysis | Reviewing facts, considering formal report, planning new security measures |
| Suspect identified | None publicly named | None publicly named |
How this compares to South Korea’s other 2026 breaches
Placed alongside the rest of South Korea’s breach disclosures this year, the megachurch incidents stand out for hitting an institutional category, large religious organizations, that rarely appears in breach-tracking data at this scale. Banks, telecoms, and e-commerce platforms dominate most annual breach tallies; a pair of megachurches holding close to a million combined member records is a different kind of target, and one that may have been chosen precisely because church IT security budgets tend to be smaller relative to the sensitivity of the data they hold.
| Incident | Sector | Reported scale | Government response |
|---|---|---|---|
| Yoido Full Gospel Church (Oct. 2026) | Religious institution | Up to 960,000 members | Presidential order for AI-hacking response, KISA investigation |
| Sarang Community Church (Oct. 2026) | Religious institution | 89,000+ members, 286 staff | Church-level review, part of same presidential response |
| South Korea bank hacks (2026) | Financial services | ~68,000 records cited in government probe | Formal AI-use investigation, per prior Tech Insider coverage |
| Hyundai Capital hack (2026) | Lending/finance | Data tied to 146 loan agents | Disclosure-timeline pressure on lenders |
| Four-breach banking cluster (2026) | Financial services | Multiple institutions | Mandatory security checks ordered sector-wide |
The pattern across these cases is a government that has moved from reactive statements to mandatory sector-wide checks within a single year, first for banks, now potentially for large non-profit and religious organizations holding comparable volumes of personal data. Whether that translates into a formal regulatory framework for religious institutions, which currently sit outside the data-protection regimes applied to regulated financial or healthcare entities, is one of the open questions this case raises.
Historical context: megachurches as data-rich, security-light targets
South Korea has one of the highest concentrations of large Protestant megachurches in the world, with Yoido Full Gospel Church long cited as one of the largest single congregations globally. That scale has always meant large membership databases, but it has not historically come with the same security scrutiny applied to banks or telecoms, since churches are typically registered as religious or non-profit organizations rather than regulated data processors. The donation and tithing records reportedly dating back to 1993 in the Yoido case underline how long these databases have been accumulating sensitive financial and personal information without the kind of periodic security audits that financial regulators require of banks.
That gap between data sensitivity and security investment is not unique to Korea, but the scale here, nearly a million combined records across two institutions, makes it one of the largest disclosed breaches of a religious organization’s data anywhere to date. It also arrives in a year when South Korean authorities have already been walking back assumptions about which sectors need mandatory cybersecurity oversight, following the banking-sector incidents that prompted this year’s security-check order.
Market and industry impact
For South Korea’s cybersecurity services industry, incidents like this tend to translate directly into new contracts. Churches, hospitals, universities, and other data-rich but historically under-secured institutions have become a growth segment for firms selling breach detection, log monitoring, and incident response services, precisely because KISA notifications like the one Yoido received highlight how often internal teams are not catching intrusions on their own. Expect outside security firms, the same category Yoido brought in for its emergency review, to see increased demand from similarly structured non-profits and religious organizations looking to avoid becoming the next disclosure.
There is also a reputational and donation-side risk specific to churches that does not apply the same way to a bank’s customer base. Tithing and donation records are deeply personal financial data, and a breach touching decades of giving history, as described in the Yoido case, could affect member trust in ways that are harder to quantify than a typical consumer data breach. If membership or donation levels dip in the months following disclosure, that would be a distinctly different kind of market impact than the stock-price moves typically associated with corporate breaches.
What happens next in the investigation
Both churches are still deciding whether to formally request a police investigation rather than leaving the matter with KISA alone, according to SBS News. That decision matters because a formal police referral would open the door to a criminal investigation capable of pursuing suspects across jurisdictions, including potentially outside South Korea if the AI-tooling angle Reuters flagged points toward a foreign actor. Without that referral, the response stays largely administrative and defensive: security hardening, member notification, and cooperation with KISA’s technical review.
President Lee’s directive to devote government resources to AI-driven hacking response suggests the investigation will not stay confined to KISA’s typical scope. Whether that results in new legislation covering data security at religious and non-profit institutions, similar to the sector-wide bank security checks ordered earlier this year, is likely to become clearer over the coming weeks as the forensic review on both churches’ systems concludes.
Predictions: where this story goes from here
- The final confirmed victim count for Yoido will likely settle somewhere between the 850,000 and 960,000 figures once forensic firms deduplicate overlapping records, rather than matching either number exactly.
- Expect at least one more South Korean religious or non-profit institution to disclose a related or copycat incident within the next one to two months, given how closely the Yoido and Sarang timelines already overlap.
- South Korea’s government is likely to extend some version of the mandatory security-check framework already applied to banks to large religious and non-profit organizations holding comparable data volumes.
- If the AI-tooling angle Reuters raised is substantiated by KISA’s technical review, it will intensify the policy debate already underway following the CrowdStrike-flagged bank-hacking cases, pushing South Korea toward faster AI-specific cybersecurity rules.
- Both churches are likely to face member-facing credit-monitoring or identity-protection offers in the coming weeks, a step South Korean financial institutions have already normalized after the 2026 banking breaches.
Frequently asked questions
How many people were affected by the Yoido Full Gospel Church breach?
Reports vary. SBS News and Reuters cited an initial estimate of roughly 850,000 members, while later SBS News reporting described information on as many as 960,000 members. A separate server reportedly held about 330,000 donation records. Investigators have not confirmed a single final total.
What data was exposed at Sarang Community Church?
SBS News reported that Sarang-related files contained personal information, including names, addresses, and phone numbers, on more than 89,000 members, plus data on 286 employees and officials, including the senior pastor.
Who is behind the attack?
No suspect, hacking group, or arrest had been publicly identified as of this writing. Reuters reported that cybersecurity analysis suggested AI tools may have been used, but described this as an indication rather than confirmed attribution.
Is this connected to South Korea’s bank hacking investigations?
Available reporting does not establish a confirmed operational or criminal link between the megachurch breaches and the separate 2026 South Korean bank-hacking investigations. Both are being treated as parallel concerns within the government’s broader focus on AI-assisted cyberattacks.
When did KISA notify Yoido Full Gospel Church of the breach?
According to SBS News and the Seoul Economic Daily, KISA notified the church at approximately 3:00 p.m. on October 6, 2026, prompting an immediate emergency security review.
When did the actual data theft reportedly happen?
Korea JoongAng Daily and SBS News both reported that the underlying theft at both churches appeared to have occurred in August 2026, roughly two months before the October disclosures.
Have the churches requested a police investigation?
As of the latest reporting, both churches were still reviewing whether to formally request a police investigation in addition to their cooperation with KISA, according to SBS News.
What has the South Korean government done in response?
Korea JoongAng Daily and Reuters reported that President Lee Jae Myung ordered government personnel and resources devoted to responding to AI-driven hacking attacks following the disclosures at both churches.