FFWPU and Tongil Group Allegedly Hit by Data Breach, Seller Claims
Summary
A dark web forum seller claims to have obtained FFWPU and Tongil Group data between January and March 2026 by exploiting an IDOR vulnerability, including personal information, plaintext passwords, database backups, and employee ID scans.
Key points
- A seller on a dark web forum is advertising data allegedly stolen from FFWPU, the Unification Church, and affiliated Tongil Group.
- The seller claims the data was acquired between January and March 2026, primarily by exploiting an insecure direct object reference (IDOR) vulnerability.
- The advertised material reportedly includes 1.29 million lines of personal information and 6,600 account records with plaintext passwords.
- The claimed data also includes ERP MSSQL backups, an HR database Oracle dump, and a MySQL dump affecting multiple organizational domains.
- Scanned employee identification documents, including driver’s licenses, are reportedly included.
- The breach and the seller’s claims are not independently confirmed in the supplied article.
Article Details
- Victim Organization
- Family Federation for World Peace and Unification (FFWPU) and Tongil Group
- Victim Domain
- familyfedihq.org, sunhakpeaceprize.org
- Incident Type
- Alleged data breach involving internal databases and personal information; the seller claims to have primarily exploited an Insecure Direct Object Reference (IDOR) vulnerability.
- Data Types Exposed
- Personal information
- Account records containing plaintext passwords
- Enterprise Resource Planning database backups
- Scanned employee identification documents, including driver’s licenses
- Human Resources Database backup
- MySQL database dump
- Affected Records
- The seller claims 1.29 million lines of personal information and 6,600 account records containing plaintext passwords.
- Affected Data Size
- The seller claims 10GB of ERP MSSQL backups, a 300MB HRDB Oracle backup dump, and a 1GB MySQL dump.
- Ransom Or Extortion
- A dark web forum post advertises the alleged data for sale; no ransom demand is reported.
- Claim Status
- claimed