Faith-Based Daily Awareness Post 9 October 2026

These updates are shared to help raise the situational awareness of Faith-Based organizations to best defend against and mitigate the impacts from all-hazards threats including physical security, cybersecurity, and natural disasters.

Reminder there will be no reports on Monday, October 12th in observance of Indigenous People Day. Reports will remain as scheduled on Tuesday, October 13th.

PA: Police investigate vandalism of Israeli flag in Pittsburgh neighborhood

Several U.S. churches have reported vandalism targeting Israeli flags displayed in remembrance of the October 7, 2023, attacks on Israel. In Springfield, Oregon, Israeli flags were stolen from Crossfire Outreach Ministries on October 7, with additional thefts reported the following night. In McKinney, Texas, hundreds of Israeli flags displayed outside Heritage Church were pulled up and vandalized ahead of the anniversary. Investigations are ongoing, and the motives behind the incidents have not been definitively established.

Analyst Comments: The incidents highlight the potential for religious institutions and faith-based properties to become targets of vandalism because of the religious, cultural, or political significance of symbols displayed on their grounds. Israeli flags and other commemorative displays may carry heightened visibility during religious holidays, public demonstrations, and anniversaries associated with significant events.

The period surrounding the October 7 anniversary may increase the likelihood of emotionally driven acts or confrontations specifically with regards to Jewish symbols, although the timing alone does not establish a motive or direct connection to the anniversary for the above events.

Faith-based organizations can take several practical steps to reduce exposure to targeted vandalism:

• Review outdoor displays: Assess the placement of flags, memorials, and other symbolic items, particularly those accessible from public streets or walkways.
• Improve surveillance and lighting: Check camera coverage, nighttime visibility, and potential blind spots around entrances, parking areas, and outdoor displays.
• Increase awareness during significant dates: Monitor local reporting, community concerns, and credible threats around religious holidays, commemorations, and politically sensitive anniversaries.
• Establish reporting procedures: Encourage staff and congregants to report suspicious behavior, threats, and property damage promptly to security personnel or local law enforcement.
• Prepare for escalation: Review response procedures for repeated vandalism, threatening messages, or confrontations involving visitors, demonstrators, or counterprotesters.

Hackers target two South Korean megachurches, potentially exposing congregant data

Two major South Korean Protestant churches are investigating cyberattacks that may have exposed sensitive information belonging to hundreds of thousands of congregants. The compromised data reportedly includes member and employee data, internal communications, and administrative documents. Oasis Security researchers, who published the initial report, identified multiple intrusion methods, including web shells, previously leaked passwords, and vulnerabilities in internal applications. The attackers may have also used artificial intelligence to identify vulnerabilities, navigate internal networks, and extract data.

Notably, researchers identified infrastructure reused in an earlier compromise of a U.S.-based Christian content platform, suggesting a potential technical connection between incidents affecting separate religious organizations.

Analyst Comments: The reported reuse of infrastructure associated with an earlier compromise of a U.S.-based Christian content platform highlights how cyber incidents targeting one faith-based organization can create follow-on risks across the faith-based community.

Faith-based organizations may reduce these risks by:

• Securing third-party relationships and connected systems.
• Addressing known vulnerabilities and compromised credentials.
• Monitoring for suspicious activity that could indicate further compromise.