AI Risk Wire

Cases › security breach › LR-2026-0809

Yoido Full Gospel Church (Seoul) customer and member database breach, 850,000 members potentially affected, AI sub-agent traces found

Confirmed Why: 2 independent outlets · 2 independent reports

Status: action reported, no fix

Severity moderate
Reported 7 Oct 2026
Industry religious organisation

No source states: loss or records, developer and model, agent tool, could do, deployer.

Yoido Full Gospel Church in Seoul reported that data tied to about 850,000 members may have been compromised, including names, birth dates and a log of changes to ID numbers, phone numbers and addresses. Security firm Oasis Security found the data on an overseas server alongside attack logs that referenced AI sub-agents and looked machine-generated, though AI's exact role is unclear. South Korea's internet security agency KISA flagged the suspected breach to the church on Tuesday afternoon. The church has since blocked outside access to its systems, changed its server passwords and begun notifying members. No hacker group or nation-state has been publicly confirmed as responsible for either breach, and the church is still working out how the intruders got in.

What happened

1 · What went wrongPersonal data tied to about 850,000 members may have been stolen from the church.
2 · What it reached or didThe initial review found names and dates of birth, plus a log of changes members had made to their records.
3 · How it was caughtSouth Korea's internet security agency KISA flagged the suspected breach to the church.

What was done

The church blocked outside access, changed server passwords and began notifying members.

Risks

Data leaked or sent out
Primary32 incidents
Credential and privilege abuse
Also37 incidents
AI used to run a cyber attack
Also96 incidents
Rising: 24 vs 4.0 a week

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Harness

Network egress control

Application

Sensitive-data checks on outbound data · Output filtering and redaction · Human approval for high-impact actions · Data minimisation · Least-privilege access for the agent · Activity logs

Similar incidents

Students caught wearing or possessing AI smart glasses during Seoul university essay examinations2026-10-30
Police officer arrested in Seoul over AI-generated sexual deepfakes2026-10-04

All cases of this kind ›

Evidence

No source states: what the AI was doing, when it happened, when it was found, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.

Show the full account: 5 items from the primary sources

What happened, in order

  1. 2026-10-06 President Lee Jae Myung said AI appeared to have played a role in recent cyberattacks in the country.
  2. 2026-10-07 Yoido Full Gospel Church publicly stated that data tied to about 850,000 members may have been compromised.

Not dated in the sources:

  • KISA flagged the suspected breach to the church.
  • Church blocked outside access, changed server passwords and began notifying members.
  • Church plans to replace its firewall and bring in security firms to hunt for other weaknesses.
Show every field, with its source and grade

What happened

Earliest source we hold
2026-10-07
C one secondary source states it
Who caught it
an outside party
C one secondary source states it
Who caused it
an outside attacker
C one secondary source states it
What was stopped
Outside access to church systems blocked
C one secondary source states it
What went wrong
security breach
C one secondary source states it
primary risk
RK04
D inferred by us from the described behaviour, reason shown
secondary risks
RK03, RK07
D inferred by us from the described behaviour, reason shown

Impact

Severity
moderate
D inferred by us from the described behaviour, reason shown
Kind of harm
privacy
C one secondary source states it
Who was affected
Members of Yoido Full Gospel Church, about 850,000 people, whose personal data may have been stolen
C one secondary source states it

Context

Industry
religious organisation
C one secondary source states it
Country
South Korea
C one secondary source states it

Notes on gaps

Attacker identity and attribution are unknown. Sarang Church's 89,000 members and stolen-credential intrusion concern a different organisation and are not recorded as Yoido values. The ARTEX trace was not linked to these incidents.

LR-2026-0809 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON