Yoido Full Gospel Church, the Seoul megachurch once recognized by Guinness as the largest congregation in the world, said Wednesday that personal data tied to 850,000 members may have been compromised, including names, birth dates and a log of changes members had made to their ID numbers, phone numbers and addresses.

The church's initial review produced the findings, which it detailed in a statement: "The file contained 2,629 changes to resident registration numbers, 3,964 changes to phone numbers and 7,202 changes to addresses." Resident registration numbers serve as South Korea's lifelong national identification numbers, which makes files that pair them with members' contact details and change histories especially sensitive.

South Korea's internet security agency, the Korea Internet & Security Agency (KISA), flagged the suspected breach to the church on Tuesday afternoon. The church has since blocked outside access to its systems, changed its server passwords and begun notifying members. The suspected cyberattack at Yoido was reported by the Korea Times.

Data Found on Overseas Server

Oasis Security, a cybersecurity company, discovered the data on an overseas server that also held attack logs and account details linked to Yoido and a second Seoul megachurch, Sarang Church. The firm came across it in September while tracing internet addresses tied to suspected attacks, and laid out its findings in a blog post analyzing cyber intrusions targeting major religious organizations in South Korea.

Sarang's haul is smaller: about 89,000 member records and 286 employee records, including the senior pastor's. The logs suggest the data was stolen in August, and the church has formed an emergency task force and reported the incident to authorities.

Signs of AI Sub-Agents

Oasis said the attack records show activity of AI sub-agents — helper programs that an AI model launches to handle separate chunks of a job — along with long attack reports that look machine-written. The churches are still working out how the intruders got in, and AI's exact role remains unclear.

Parallel Bank Hack Probe

The church breach surfaced as South Korea investigates suspected AI-assisted hacks at commercial banks, including Shinhan Bank. President Lee Jae Myung confirmed Tuesday that AI is believed to have been used in the recent bank hacks. Shinhan's breach exposed names, phone numbers, annual income and borrowing limits for about 25,000 customers, according to local news reports, and the financial regulator opened an emergency on-site inspection.

Ongoing Response

Yoido Full Gospel Church said it plans to replace its firewall — the filter that blocks unwanted traffic into a network — and bring in security firms to hunt for other weaknesses while it notifies the 850,000 members whose data may be affected. The firewall replacement, the security firms' review and further findings from Oasis Security and KISA are the milestones to watch as the investigations into the church breaches and the bank hacks remain ongoing.