Hackers Breach Two Major South Korean Churches, Exposing Data of Over 1 Million People

Hackers breached two major South Korean churches, exposing more than one million congregant records and extensive financial and administrative data.

The investigation reveals how web shells, leaked credentials, and weak access controls opened routes into connected systems. In one case, attackers entered through a web shell planted in an enterprise resource planning, or ERP, system.

In the other, they used leaked credentials and insecure direct object reference, or IDOR, flaws in groupware and membership systems to reach sensitive records.

Analysts at OASIS identified the activity after examining files recovered from an attacker-controlled server. The evidence points to a multi-stage campaign involving database access, internal movement, and cloud staging, rather than a single malware strain.

OASIS said in a report shared with Cyber Security News (CSN) that the attackers collected records connected to congregants, donations, payroll, employee data, approval documents, chats, and identity information.

That is particularly concerning because community organizations can hold sensitive information that criminals could use for fraud or targeted scams. Unique-person totals remain unverified.

Hackers Breach Two Major South Korean Churches

Researchers collected files from an attacker server between August 28 and September 1, 2026. The U.S.-based server contained tooling, stolen data, and operator reports related to both victims.

The first intrusion involved a web shell in the church’s ERP system. Attackers reversed ERP application files, decrypted database settings, and obtained administrator access to Microsoft SQL Server.

They then used xp_cmdshell, a SQL Server feature that can launch operating-system commands, to move across linked systems.

That access opened member, accounting, access-control, library, chat, and mail databases. Attackers bypassed a database-monitoring control, recovered a MariaDB root password, and used hardcoded NAS credentials to reach backup storage.

Similar misuse has appeared in SQL Server attack investigations, where a database becomes a route to the underlying Windows host.

The collection contained about 960,000 congregant records updated in the previous two years, including names and resident registration numbers.

It also included roughly 330,000 donation records, 68,000 document-creation records, more than 14,000 chats, and 6,874 login accounts. Researchers recovered 47.3 GB across 13,939 files from a compromised MinIO bucket used to stage the data.

The second church was targeted earlier through leaked credentials, groupware, and IDOR weaknesses in EKP and SIMS services. An IDOR flaw occurs when an application accepts a user-controlled record reference but fails to confirm the requester is allowed to access it.

The issue resembles the unauthenticated API data exposure reported in another faith-related service. Using a member session, attackers viewed other users’ plaintext PINs and reset a manager-privileged account.

They accessed about 89,000 congregant records, 383 employee records, 286 human-resources entries, 96 employee photos, and approval documents. The investigation also found exposed college-ministry APIs and cloud storage configured for unrestricted read and write access.

How Defenders Can Respond

Neither intrusion was a one-step event. The first progressed from internet-facing application access to database administration, remote command execution, network storage, and off-site staging.

The second turned leaked credentials and missing authorization checks into access across groupware, SIMS, SAP, and connected services.

Organizations should remove unauthorized web shells, rotate exposed passwords and tokens, and invalidate active sessions. They should inspect ERP, database, NAS, and cloud logs for unusual access, large exports, or connections to the infrastructure listed below.

Credentials found in backups, application settings, public code, or exposed storage should be treated as compromised. Administrators should disable xp_cmdshell where it is not essential, restrict linked-server privileges, and segment database systems.

Teams should investigate suspicious command execution under SQL Server service accounts, particularly activity reaching other internal hosts. For web applications, every request must verify both identity and permission to access the requested record.

Authorization testing, least privilege, and safer password-reset functions can prevent IDOR chains like this one. Earlier IDOR vulnerability mitigation coverage stresses patching, auditing sensitive changes, and rotating service credentials.

The report warns that AI can accelerate reverse engineering, vulnerability research, lateral movement, and exfiltration. Faster attacker workflows give defenders less time to detect and contain intrusions before sensitive data leaves internal systems.

Indicators and investigation artifacts below reproduce the source values exactly. Redacted addresses are not actionable indicators, and legitimate files require contextual investigation rather than automatic blocking. No literal file-hash values were published.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC