Yoido Full Gospel Church says data of 850,000 members may have leaked in cyberattack

Yoido Full Gospel Church, described in the documents as South Korea's largest church, said on Oct. 7 that the names and dates of birth of about 850,000 members may have been exposed after a cyberattack on its information system. The church said it was notified by the Korea Internet & Security Agency (KISA) at 3 p.m. on Oct. 6 of signs that its system had been compromised, and immediately began an emergency security review with outside security specialists, analysing suspect files and system access logs. [ 1 , 2 , 3 , 5 ]

The church said that of seven suspect files, six — covering transfer records between parishes, appointments to church positions and baptism records — contained no personal information. One file, a member information change history, did contain some personal data, the church said. According to reports citing the church, that file held the names and dates of birth of 850,000 people, including 2,629 resident registration number change records, 3,964 phone number change records and 7,202 address change records. Past donation records were also among the suspect files, but the church said these contained only voucher numbers, amounts and descriptions, not personal information. [ 1 , 2 , 3 , 5 ]

The church said it was notifying affected members of the exposure in line with relevant laws and procedures. It said it had blocked external access, deleted malicious files and changed server and related account passwords, with a change of all user passwords under way, and that it would replace its existing firewall and work with security firms on vulnerability analysis and further hardening. Yonhap reported that the external access block and server password change were carried out at 1 a.m. on Oct. 7. [ 1 , 2 , 5 ]

Senior pastor Lee Young-hoon apologised, saying “the responsibility to safely manage and protect the precious personal information of members lies with the church” and that he felt “heavy responsibility” as senior pastor for causing members concern. He said the church took the matter seriously, would actively cooperate with the investigations and verification procedures of relevant authorities, and would take all necessary measures to prevent a recurrence. [ 1 , 2 , 5 ]

The incident came to light after cybersecurity firm Oasis Security said it had identified large volumes of church member data on an overseas attacker server, including data from two large South Korean churches. Besides Yoido Full Gospel Church, Sarang Church in Seoul's Seocho district was also hacked, according to that account. The documents do not name any attacker or give further details on the Sarang Church case. [ 1 , 2 ]

Outlets differed slightly in how firmly they described the leak: some reported that the data had been leaked, while the church and other reports described it as suspected, pending analysis of the files believed to have been exposed. The documents do not specify how many individuals' resident registration numbers, phone numbers or addresses were actually exposed. [ 1 , 2 , 3 , 5 ]