South Korea's Yoido Full Gospel and SaRang megachurches breached; data of about 850,000 and 89,000 members suspected leaked

According to Yonhap, security firm Oasis Security found data from two large Korean churches on an overseas attacker server; one was breached via a web shell on its ERP server with database admin rights obtained, while the other's groupware was accessed with previously obtained accounts and then its ERP via single sign-on ^[2]. Yoido Full Gospel Church said a suspected-leaked member change history contains names and birth dates of 850,000 people, including 2,629 resident registration number change records, while data of about 89,000 SaRang Church members and 286 staff was found on the attacker server ^[1][4]. According to reports, researchers advise organizations to review how core HR, accounting, groupware and database systems connect and how their authentication and permissions are set up ^[2].

Industries mainly affected: Cross-industry

1. Organizations should review how core HR, accounting, groupware and database systems connect and their authentication and permission setup .