Even Prayer Can't Patch a Firewall: AI Sub-Agents Drained 850K Church Records 🛐

South Korea's Yoido Full Gospel Church, once recognized by Guinness as the world's largest congregation, said Wednesday that personal data tied to 850,000 members may have been stolen, with investigators pointing to AI-powered intruders. The Seoul megachurch's initial review found exposed names, dates of birth and a log of member-driven record changes, including "2,629 changes to resident registration numbers, 3,964 changes to phone numbers and 7,202 changes to addresses," according to a church statement. South Korea's internet security agency, KISA, flagged the suspected breach to the church on Tuesday afternoon, and the church has since blocked outside access to its systems, changed its server passwords and begun notifying members.

Oasis Security, a cybersecurity firm, located the data on an overseas server that also held attack logs and account details linked to a second Seoul megachurch, Sarang Church. Oasis said it came across the trove in September while tracing internet addresses tied to suspected attacks. Sarang's haul is smaller, comprising about 89,000 member records and 286 employee records, including those of the senior pastor. The logs indicate the data was stolen in August, and Sarang has formed an emergency task force and reported the incident to authorities.

The two churches are still working out how the intruders got in, though the Oasis report describes attack records that show activity of AI sub-agents — helper programs an AI model launches to handle separate chunks of a job — along with lengthy attack reports that appear machine-written. AI's precise role in the breach remains unclear. President Lee Jae Myung confirmed Tuesday that AI is believed to have been used in recent hacks on South Korean commercial banks, including a Shinhan Bank incident that exposed names, phone numbers, annual income and borrowing limits for about 25,000 customers and prompted an emergency on-site inspection by the financial regulator. Yoido Full Gospel Church said it plans to replace its firewall, the filter that blocks unwanted traffic into a network, and bring in security firms to search for additional weaknesses as it notifies the 850,000 members whose data may be affected.