South Korean Churches Compromised in Massive Data Breach Affecting Over One Million Members

Cybersecurity investigators have confirmed that two of South Korea's largest Christian congregations suffered a coordinated intrusion that exposed personal information for more than one million adherents, along with extensive financial and administrative records.

According to the technical analysis, the attackers gained entry through a combination of compromised login credentials and poorly secured web shells that were left on the churches' public-facing servers. Once inside, they were able to move laterally across interconnected systems, harvesting data that included contact details, donation histories, and internal communications.

The breach underscores a growing trend in which religious organizations, traditionally viewed as low‑risk targets, become attractive to cybercriminals seeking large volumes of personal data. South Korea, a nation with one of the highest internet penetration rates in the world, has seen a surge in ransomware and data‑theft incidents over the past few years, prompting calls for stronger digital safeguards across all sectors.

Church officials have not disclosed the full extent of the compromised material, but they confirmed that the affected databases contain records dating back several years. The organizations are now working with law enforcement and independent security firms to assess the damage, notify members, and reinforce their network defenses. They have also urged congregants to monitor their accounts for any unusual activity.

Experts say the incident highlights the importance of robust access‑control policies, regular credential rotation, and the removal of unnecessary services such as web shells that can serve as backdoors. As authorities continue to investigate, the breach may prompt regulatory bodies to tighten cybersecurity requirements for non‑profit institutions, especially those handling sensitive donor information.