Hackers Breach Two South Korean Megachurches, Exposing Data of Up to 850,000 Members
What Happened — Hackers infiltrated the IT environments of Yoido Full Gospel Church and SaRang Church, installing a web shell on one system and leveraging leaked passwords and unpatched application flaws on the other. They obtained administrator‑level access, extracted over 47 GB of data—including personal identifiers, financial records, payroll, and internal communications—and accessed the churches’ SAP business‑process platform.
Why It Matters for Trust & Control Assurance —
- Continuous monitoring of privileged accounts would have flagged the unexpected admin‑level activity.
- Evidence‑driven audit trails of access‑control changes provide a defensible record for regulators and stakeholders.
- Demonstrates the need for a formal access‑control program that includes MFA, least‑privilege principles, and regular credential hygiene.
Who Is Affected — Large religious organizations with extensive member databases; indirectly, any entity that stores personal and financial data for hundreds of thousands of individuals.
Recommended Actions —
- Perform an immediate privileged‑account review; enforce multi‑factor authentication for all admin users.
- Deploy web‑shell detection and continuous log analysis to surface anomalous remote commands.
- Patch identified application vulnerabilities, rotate compromised credentials, and validate SAP access controls.
- Update incident‑response playbooks to include credential‑theft scenarios and third‑party forensic assistance. Source: The Record
Technical Notes — Attackers used a web shell to gain remote control, exploited leaked passwords and unpatched internal applications to reset accounts, and accessed SAP ERP systems. Data exfiltrated comprised personal identifiers, financial contributions, payroll, and internal communications. Source: The Record