{"slug": "hackers-who-may-have-used-ai-agents-stole-data-on-nearly-a-million-members-of", "title": "Hackers who may have used AI agents stole data on nearly a million members of Seoul’s biggest church", "summary": "Yoido Full Gospel Church and SaRang Church in Seoul confirmed on Wednesday they are investigating suspected data breaches after security firm Oasis Security recovered attack tools and logs from an overseas attacker's server last month, according to the Korea JoongAng Daily. The server held about 330,000 donation records from Yoido Full Gospel Church taken in August, details of about 960,000 church members updated over the past two years, about 68,000 internal approval documents, and 14,706 internal messaging records; Yoido Full Gospel Church's own review found the names, dates of birth and other personal details of 850,000 members may have leaked, while SaRang Church data on the server included 286 records on staff and officials and information on more than 89,000 members. Oasis Security said the attacker's logs referred to a \"sub-agent\" and included an \"attack handover report,\" though neither church nor Korean authorities have confirmed AI was used; the breaches follow attacks on South Korean banks including KB Kookmin, Hana and Shinhan where researchers found traces of the ARTEX hacking tool.", "body_md": "Yoido Full Gospel Church in Seoul, lit up for Christmas in December 2016. Image: [Striker9498](https://commons.wikimedia.org/wiki/File:20161204_%EC%97%AC%EC%9D%98%EB%8F%84%EC%88%9C%EB%B3%B5%EC%9D%8C%EA%B5%90%ED%9A%8C.jpg) / Wikimedia Commons, CC0, cropped\n\nTwo of South Korea’s biggest churches say their members’ personal data may have been stolen, in the latest of a run of attacks on Korean organisations that investigators think may have used AI. Yoido Full Gospel Church, billed as the world’s largest Protestant church by membership, and SaRang Church, both in Seoul, [confirmed on Wednesday](https://www.koreajoongangdaily.com/korea/cyberattacks-expose-member-data-donation-records-at-two-seoul-megachurches-report-says/12908689) that they are investigating suspected breaches.\n\nThe leaks came to light after security firm Oasis Security recovered attack tools and logs from an overseas attacker’s server last month, the Korea JoongAng Daily reports.\n\n## What was on the attacker’s server\n\nAccording to Oasis Security, the server held about 330,000 donation records from Yoido Full Gospel Church that appear to have been taken in August, along with details of about 960,000 church members updated over the past two years. It also held about 68,000 internal approval documents and 14,706 records of conversations on the church’s internal messaging system.\n\nYoido Full Gospel Church’s own review found that the names, dates of birth and other personal details of 850,000 members may have leaked, [the Korea Herald reports](https://www.koreaherald.com/article/10895635). The church said it had been alerted by the Korea Internet and Security Agency (KISA) and was working with the authorities and security experts “to determine exactly what happened”.\n\nData from SaRang Church’s human resources system was also on the server: 286 records on staff and officials, including its senior pastor, and information on more than 89,000 members. SaRang said it had set up an emergency task force and reported the incident to the authorities.\n\n## Signs of an AI agent at work\n\nOasis Security says the attacker’s logs referred to a “sub-agent”, a term used for an AI system that carries out tasks handed to it by another AI. The server also held an “attack handover report” summing up what had been taken, how the churches’ internal systems were laid out and which accounts had been compromised.\n\n“The attacker appears to have exploited authentication and authorization vulnerabilities to expand access to major internal systems,” the firm said. Neither church nor the Korean authorities have confirmed that AI was used, and Oasis Security has not said who it thinks is behind the attack.\n\n## Part of a wider wave\n\nThe church breaches follow [attacks on South Korean banks](https://madrobot.blog/2026/10/02/south-korea-banks-shinhan-kb-kookmin-hana-hacked-ai-tool-artex-suspected/) including KB Kookmin, Hana and Shinhan, where security researchers found traces of ARTEX, a hacking tool that describes itself as an “AI autonomous penetration test console”. On Monday, South Korea’s President Lee said AI may have been used in those attacks, and police set up a dedicated team to investigate.\n\nChurches hold a lot of sensitive information on their members, from addresses and family details to how much each person gives, which makes them an attractive target and a sensitive one to lose.\n\n## Why it matters\n\nIf the “sub-agent” logs are what they appear to be, attackers are now handing whole intrusions to AI agents and getting a neat written report at the end. The same playbook used on Korea’s banks is now reaching organisations with far smaller security budgets, and nearly a million churchgoers may be the latest to pay for it.\n\n*Sources: [Korea JoongAng Daily](https://www.koreajoongangdaily.com/korea/cyberattacks-expose-member-data-donation-records-at-two-seoul-megachurches-report-says/12908689), [The Korea Herald](https://www.koreaherald.com/article/10895635).*", "url": "https://wpnews.pro/news/hackers-who-may-have-used-ai-agents-stole-data-on-nearly-a-million-members-of", "canonical_source": "https://madrobot.blog/2026/10/07/yoido-full-gospel-sarang-church-data-breach-ai-agent-hack/", "published_at": "2026-10-07 07:22:00+00:00", "updated_at": "2026-10-07 07:48:32.975617+00:00", "lang": "en", "topics": ["ai-agents", "artificial-intelligence", "ai-safety"], "entities": ["Yoido Full Gospel Church", "SaRang Church", "Oasis Security", "Korea Internet and Security Agency (KISA)", "Korea JoongAng Daily", "The Korea Herald", "ARTEX", "Lee Jae Myung"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/hackers-who-may-have-used-ai-agents-stole-data-on-nearly-a-million-members-of", "markdown": "https://wpnews.pro/news/hackers-who-may-have-used-ai-agents-stole-data-on-nearly-a-million-members-of.md", "text": "https://wpnews.pro/news/hackers-who-may-have-used-ai-agents-stole-data-on-nearly-a-million-members-of.txt", "jsonld": "https://wpnews.pro/news/hackers-who-may-have-used-ai-agents-stole-data-on-nearly-a-million-members-of.jsonld"}}