{"schema_version":"0.10.0","id":"LR-2026-0809","record_version":1,"title":"Yoido Full Gospel Church (Seoul) customer and member database breach, 850,000 members potentially affected, AI sub-agent traces found","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":51.5,"score_breakdown":{"source_authority":12.1,"independent_corroboration":15.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":4.48,"unhedged_language":3.33},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"2 independent outlets","original_document":null,"reports_total":2,"reports_independent":2,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"2 independent outlets"}]},"sources_hash":"d24076ac619efa17560e1ce295a694a7d72119b18fce82164dff039585e41c8a"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-07","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"Yoido Full Gospel Church in Seoul reported that data tied to about 850,000 members may have been compromised, including names, birth dates and a log of changes to ID numbers, phone numbers and addresses. Security firm Oasis Security found the data on an overseas server alongside attack logs that referenced AI sub-agents and looked machine-generated, though AI's exact role is unclear. South Korea's internet security agency KISA flagged the suspected breach to the church on Tuesday afternoon. The church has since blocked outside access to its systems, changed its server passwords and begun notifying members. No hacker group or nation-state has been publicly confirmed as responsible for either breach, and the church is still working out how the intruders got in.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":"Outside access to church systems blocked","remediation":null,"precursor_events":null,"primary_risk":"RK04","secondary_risks":["RK03","RK07"]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","harm_class":["privacy"],"affected_description":"Members of Yoido Full Gospel Church, about 850,000 people, whose personal data may have been stolen","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://decrypt.co/380339/hackers-ai-agents-megachurch-database","publisher":"Decrypt","date":"2026-10-07","type":"press","title":"Hackers Used AI Agents to Raid a Megachurch's Database, Exposing 850,000 Members - Decrypt","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://tech-insider.org/south-korea-megachurch-cyberattack-850000-members-2026/","publisher":"https://tech-insider.org/","date":"2026-10-09","type":"press","title":"South Korea Megachurch Hack Hits 850,000 Members [2026] - https://tech-insider.org/","archived_url":null,"independence":"independent"}],"per_field_confidence":{"event.incident_class":"C","event.detection_method":"C","event.adversarial_actor":"C","event.date_disclosed":"C","event.operations_paused":"C","impact.affected_description":"C","impact.harm_class":"C","context.industry":"C","context.country":"C","impact.severity":"D","event.primary_risk":"D","event.secondary_risks":"D","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","system.developer":"D","context.denominator_available":"D"},"field_citations":{"event.incident_class":[{"source_index":0,"quote":"Yoido Full Gospel Church, the Seoul megachurch Guinness once recognized as the largest congregation in the world, said Wednesday that personal data tied to 850,000 members may have been stolen."}],"event.detection_method":[{"source_index":1,"quote":"That detail is notable on its own: the church learned about the intrusion from South Korea’s national cybersecurity agency rather than detecting it through its own monitoring."}],"event.adversarial_actor":[{"source_index":1,"quote":"Oasis Security said it located data tied to both churches sitting on a server controlled by an overseas hacker, which is how the scope of the incident first came into focus."}],"event.date_disclosed":[{"source_index":1,"quote":"Yoido Full Gospel Church in Seoul, described in multiple reports as the country’s largest registered congregation, said on October 7, 2026, that an initial review found data tied to roughly 850,000 members may have been compromised."}],"event.operations_paused":[{"source_index":0,"quote":"The church has since blocked outside access to its systems, changed its server passwords and begun notifying members."}],"impact.affected_description":[{"source_index":0,"quote":"Yoido Full Gospel Church, the Seoul megachurch Guinness once recognized as the largest congregation in the world, said Wednesday that personal data tied to 850,000 members may have been stolen."}],"impact.harm_class":[{"source_index":0,"quote":"The church’s initial review found names and dates of birth, plus a log of changes members had made to their records."}],"context.industry":[{"source_index":1,"quote":"Religious and nonprofit institutions are not public companies, so there is no stock price to move on this news."}],"context.country":[{"source_index":0,"quote":"South Korea's internet security agency, KISA, flagged the suspected breach to the church on Tuesday afternoon."}],"impact.severity":[{"source_index":0,"quote":"Yoido Full Gospel Church, the Seoul megachurch Guinness once recognized as the largest congregation in the world, said Wednesday that personal data tied to 850,000 members may have been stolen."}],"event.summary":[{"source_index":0,"quote":"Yoido Full Gospel Church in Seoul said Wednesday that data tied to 850,000 members may have been compromised, including names, birth dates and a log of changes to ID numbers, phone numbers and addresses."},{"source_index":0,"quote":"Security firm Oasis Security found the data on an overseas server alongside attack logs that referenced AI sub-agents and looked machine-generated, though AI's exact role is unclear."},{"source_index":0,"quote":"South Korea's internet security agency, KISA, flagged the suspected breach to the church on Tuesday afternoon."},{"source_index":0,"quote":"The church has since blocked outside access to its systems, changed its server passwords and begun notifying members."},{"source_index":1,"quote":"No hacker group or nation-state has been publicly confirmed as responsible for either breach."}]},"notes_on_gaps":"Sources do not name the AI model, developer, harness, tools or autonomy level, and do not confirm the AI role (Oasis said AI's exact role is unclear), so agent_involved, failure_class and system fields were left out. Attacker identity and attribution are unknown. The Yoido occurrence date is not stated (August refers to donation records in source 1 and to Sarang in source 0), so date_occurred is omitted. The detection date is given only as Tuesday afternoon, so date_detected is omitted. Root cause, trigger and responsible party are not stated by the church and were left out; source 1 general commentary was not used as a root cause. Figures of 960,000 member records, 330,000 donation records and 96,000 records conflict with the church's 850,000 figure and were not used. Sarang Church's 89,000 members and stolen-credential intrusion concern a different organisation and are not recorded as Yoido values. The ARTEX trace was not linked to these incidents. Severity moderate is my judgement: bounded scope of one church's members is stated, and the count of affected parties is stated but not confirmed. The planned firewall replacement is recorded as a plan, not a completed change. The J2 control mapping for the password change is my judgement. The A1 failed mapping is my judgement from the administrator-level access statement. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (2 independent outlets)]"},"context":{"industry":"religious organisation","org_size_band":null,"country":"KR","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"Personal data tied to about 850,000 members may have been stolen from the church.","quote":"Yoido Full Gospel Church, the Seoul megachurch Guinness once recognized as the largest congregation in the world, said Wednesday that personal data tied to 850,000 members may have been stolen.","source_index":0,"grade":"C"},{"step":"reached","text":"The initial review found names and dates of birth, plus a log of changes members had made to their records.","quote":"The church’s initial review found names and dates of birth, plus a log of changes members had made to their records.","source_index":0,"grade":"C"},{"step":"caught","text":"South Korea's internet security agency KISA flagged the suspected breach to the church.","quote":"South Korea's internet security agency, KISA, flagged the suspected breach to the church on Tuesday afternoon.","source_index":0,"grade":"C"},{"step":"done","text":"The church blocked outside access, changed server passwords and began notifying members.","quote":"The church has since blocked outside access to its systems, changed its server passwords and begun notifying members.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://decrypt.co/380339/hackers-ai-agents-megachurch-database","https://tech-insider.org/south-korea-megachurch-cyberattack-850000-members-2026/"]},"analysis":{"sections":{"timeline":[{"text":"President Lee Jae Myung said AI appeared to have played a role in recent cyberattacks in the country.","quote":"The disclosure lands just three days after South Korean President Lee Jae Myung said AI appeared to have played a role in recent cyberattacks hitting the country, a comment made October 6 as authorities were still working out exactly how.","source_index":1,"when":"2026-10-06"},{"text":"KISA flagged the suspected breach to the church.","quote":"South Korea's internet security agency, KISA, flagged the suspected breach to the church on Tuesday afternoon.","source_index":0,"when":"Tuesday afternoon"},{"text":"Yoido Full Gospel Church publicly stated that data tied to about 850,000 members may have been compromised.","quote":"Yoido Full Gospel Church in Seoul, described in multiple reports as the country’s largest registered congregation, said on October 7, 2026, that an initial review found data tied to roughly 850,000 members may have been compromised.","source_index":1,"when":"2026-10-07"},{"text":"Church blocked outside access, changed server passwords and began notifying members.","quote":"The church has since blocked outside access to its systems, changed its server passwords and begun notifying members.","source_index":0,"when":null},{"text":"Church plans to replace its firewall and bring in security firms to hunt for other weaknesses.","quote":"Yoido Full Gospel Church said it plans to replace its firewall, the filter that blocks unwanted traffic into a network, and bring in security firms to hunt for other weaknesses while it notifies the 850,000 members whose data may be affected.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://decrypt.co/380339/hackers-ai-agents-megachurch-database","https://tech-insider.org/south-korea-megachurch-cyberattack-850000-members-2026/"]}}