Circumstances of cyber attacks on two large churches... Possibility of large-scale leakage of church member information

(Seoul = Yonhap News) Reporter Kwon Ha-young = A security company analysis confirmed that two large domestic churches suffered cyber attacks and member personal information, donations, accounting data, and internal documents were leaked.

According to Oasis Security, a cyber threat intelligence company, on the 6th, as a result of analyzing attack tools, records, data, and account information obtained from overseas attacker servers, large-scale church member information related to two large domestic religious institutions was discovered.

Oasis Security announced that the analysis showed that the scope of the attack had expanded to other internal systems through systems accessed from the outside of both churches.

In particular, the company explained that actual data related to a domestic church was found on the overseas attacker's server, and that the data appears to have been transmitted to an external server.

According to Oasis Security, in the case of Church A, an attacker used a web shell, a malicious program, to infiltrate the enterprise resource planning (ERP) system server and secured administrator rights for the database used by the system.

The company announced that it had confirmed that the attacker had accessed services connected to other internal systems using the privileges obtained in this way.

The company explained that about 330,000 records of member donations believed to be related to Church A and about 960,000 pieces of member information updated over the past two years were discovered on the overseas attacker's server.

It was also revealed that approximately 47.3 GB of data, including approximately 68,000 electronic payment documents and 14,706 internal messenger conversation records, were also discovered.

In the case of another church, Church B, Oasis Security analyzed that the attacker accessed the groupware server using account information believed to have been obtained in advance.

According to the company, the attacker later expanded the scope of access by exploiting system vulnerabilities to access other user information and secure administrator-level accounts.

The company also said that ERP was also accessed through the integrated login function, which allows access to multiple systems with a single login, and that employee information and photos were obtained in the process.

Oasis Security announced that it had confirmed information on 89,000 church members and 286 cases of employee information believed to be related to Church B on the overseas attacker's server.

According to Oasis Security, during this analysis, it was discovered that the administrator account of an external storage server related to a violation of a religious content and streaming service in the United States was also used to store and transmit data related to domestic churches.

Based on this, the company analyzed that there is a possibility that accounts and related infrastructure secured during the breach of American religious content and streaming services were later used in attacks targeting domestic churches.

However, based on these circumstances alone, it is difficult to conclude that the subject of each attack is the same.

Oasis Security said, “There is a need to check how core business systems such as personnel and accounting systems, groupware, and databases are connected to each other and what the authentication and authorization systems are.”