The agency called at three

The call came at 3 p.m. The inventory did not.

Yoido Full Gospel Church said it began an emergency review as soon as the Korea Internet & Security Agency notified it, at 3 p.m. on 6 October, of signs of an intrusion. The church’s own account of what it did next is timed to 1 a.m. on 7 October: external access blocked, server passwords changed. That is containment. It is not a description of a file.

Oasis Security, the firm that says it found the material on an overseas attacker server, has put numbers on that server: about 960,000 records it believes are member information from the past two years, about 330,000 donation records, about 47.3 GB including some 68,000 approval documents and 14,706 internal chats, and a path it describes as a web shell on the church ERP with database-administrator rights. Those are the firm’s figures. On the day of the phone call, the church had not published which of them it could stand behind.

What the gap is for

A 960,000-row briefing will be in the group chat by morning, because the outside firm spoke and the institution had only just been told. The institution’s job overnight is not to adopt the firm’s inventory and not to deny a breach it has already been shown signs of. It is to say which set it has actually opened. Until that sentence exists, “member data” is a category, and the donation ledger and the chat logs are allegations sitting on someone else’s server.

If you are in the congregation, a call or a text that already knows a donation amount is a different object from a news article about a KISA notification. Treat the call as live. Do not treat the 960,000 as your row until the church, or a file you can see, says so.

The agency’s clock started at three. The file’s clock has not started, because nobody with the book has read a page out loud yet.