Hackers Breach Two Major South Korean Churches, Exposing Data of Over 1 Million People

Hackers breached two major South Korean churches, exposing more than one million congregant records and extensive financial and administrative data. The investigation reveals how web shells, leaked credentials, and weak access controls opened routes into connected systems. In one case, attackers entered through a web shell planted in an enterprise resource planning, or ERP, system. In the other, they used leaked credentials and insecure direct object reference, or IDOR, flaws in groupware and membership systems to reach sensitive records. Analysts at OASIS identified the activity after examining files recovered from an attacker-controlled server. The evidence points to a multi-stage campaign involving database access, internal movement, and cloud staging, rather than a single malware strain. OASIS said in a report shared…