Hackers Used AI Agents to Breach South Korean Megachurches, Exposing 850,000 Member Records

AI-Linked Cyberattacks Target Major Religious Institutions

Two South Korean megachurches are investigating suspected AI cyberattacks that exposed personal data of hundreds of thousands of congregants, marking a troubling evolution in how hackers leverage artificial intelligence for large-scale data breaches1

1

2

2

. Yoido Full Gospel Church, once recognized by Guinness as the world's largest congregation, confirmed Wednesday that data relating to 850,000 members may have been compromised3

3

. Sarang Church in Seoul's Seocho district reported a smaller but significant breach affecting approximately 89,000 member records and 286 employee records, including the senior pastor's information1

1

.

Evidence Points to AI-Assisted Attacks

Cybersecurity firm Oasis Security discovered the stolen data on an overseas server while tracing internet addresses tied to suspected attacks in September1

1

. The attack logs revealed activity of AI sub-agents, which are helper programs that an AI model launches to handle separate chunks of a job, along with extensive attack reports that appeared machine-written2

2

. These references to sub-agents and automated attack reports provide concrete evidence that hackers used AI agents to conduct the intrusions4

4

. While the churches continue working to determine how the intruders gained access, AI's precise role in the AI-assisted attacks remains under investigation1

1

.

Scope of Personal Data Exposed

The data breach at Yoido Full Gospel Church included names and dates of birth for the 850,000 affected members3

3

. Initial analysis found a log containing 2,629 changes to resident registration numbers, 3,964 changes to phone numbers, and 7,202 changes to addresses1

1

. The personal data of congregants exposed at Sarang Church included similar information, with attack logs suggesting the theft occurred in August1

1

. Both churches discovered their compromised systems through alerts from South Korea's internet security agency KISA, which flagged the suspected breach to Yoido on Tuesday afternoon1

1

.

Immediate Response and Security Measures

Yoido Full Gospel Church moved quickly to contain the damage by blocking external access to its systems and changing server passwords2

2

. The church announced plans to replace its firewall and bring in additional security firms to hunt for vulnerabilities while notifying all 850,000 members whose data may be affected1

1

. Sarang Church formed an emergency task force and reported the incident to relevant authorities, taking steps to determine what happened and prevent further harm4

4

.

Broader Pattern of AI Tools Cyberattack Investigation

These AI-linked cyberattacks on South Korean megachurches follow recent hacking attacks against commercial banks that breached customers' personal information3

3

. South Korean President Lee Jae Myung confirmed Tuesday that AI is believed to have been used in recent hacks on financial institutions1

1

. Shinhan Bank's breach exposed names, phone numbers, annual income, and borrowing limits for approximately 25,000 customers, prompting the financial regulator to open an emergency on-site inspection1

1

. The pattern emerging across religious and financial institutions suggests hackers are increasingly deploying AI agents to scale their operations and automate complex attack sequences, raising urgent questions about how organizations can defend against this new generation of threats.