Week 45, 2023 security incident report
Hacking and data breach incidents newly reported 2023.11.06 ~ 11.12
Between 6 and 12 November 2023, eight new incidents were recorded in South Korea, with allegations of a 4.5 GB hack of Ministry of Foreign Affairs email and the ministry's denial of any unauthorised access attracting the most attention. Personal data leaks and exposures continued across the education, automotive and retail sectors, including Hallym Polytechnic University's mistaken posting of resident registration number data, an alleged leak of Hyundai Motor job applicants' information and the exposure of personal data of 1,198 Zigzag customers. Account takeovers of Steam users at PC cafés led to fraudulent payments, and attacks linked to Lazarus's exploitation of a MagicLine vulnerability were detected 105 times at 40 companies and institutions. Overseas, data breaches hit about 6.9 million 23andMe users and about 14.7 million Mr. Cooper customers, while ransomware damage at the US subsidiary of Industrial and Commercial Bank of China and an attack on an Australian port operator led, respectively, to disruption to Treasury trade processing and a halt to terminal operations.
By type
- Data breach19
- Hacking & intrusion13
- Ransomware9
- DDoS2
- Phishing & smishing1
Key incidents in South Korea
South Korean foreign ministry email hacking alleged; unauthorised access denied
Impact: Alleged hacking of 4.5GB of emails
Allegations emerged that 4.5GB of South Korea's Ministry of Foreign Affairs emails were hacked by China's Ministry of State Security in January 2022. In March 2025, the US Department of Justice indicted eight Chinese hackers on charges including hacking South Korea's Ministry of Foreign Affairs. The ministry said there was no record of unauthorised access to its mailboxes.
Related reports: 5 · last report →Spate of Steam account hacks and fraudulent charges hits PC bang users
Impact: Steam user accounts hijacked and fraudulent payments
Users who accessed Steam at PC bangs (internet cafés) suffered a series of account hacks and fraudulent payments. Even accounts protected by Steam Guard were hacked.
Related reports: 3 · last report →Hallym Polytechnic University fined for mistakenly posting resident registration numbers
Impact: Leak of resident registration numbers of student loan applicants
Whilst providing information on student loans, Hallym Polytechnic University mistakenly posted on its website a document containing the resident registration numbers of students who had applied for loans. The Personal Information Protection Commission (PIPC) imposed a fine of 16.25 million won for breaching its duty to take security measures.
Related reports: 3 →Suspected leak of Hyundai Motor job applicants' personal data
Impact: Alleged leak of job applicants' personal data
Allegations arose that the personal data of Hyundai Motor job applicants had been leaked. Controversy over whether personal data had been leaked continued.
Related reports: 2 · last report →Zigzag login session error exposes personal data of 1,198 customers
1.2kImpact: Up to 11 items of personal data of 1,198 customers
On 6 November 2023, a login session error at Zigzag exposed the personal data of 1,198 customers to other users. The exposed information included up to 11 items, such as names, contact details, delivery addresses, building entrance codes and refund account details. A compensation plan giving 20,000 points to affected customers was announced.
Read on 글로벌이코노믹 ↗105 Lazarus attacks exploiting MagicLine flaw detected at 40 organisations
105Impact: 105 related attacks detected at 40 companies and institutions
Evidence was disclosed that Lazarus had exploited a MagicLine vulnerability to carry out watering hole attacks on South Korean IT companies, defence contractors and media outlets, among others. From January to July 2023, 105 related attacks were detected at 40 companies and institutions.
Read on 안랩 ↗Personal data leak at Kakao Style's Zigzag
Impact: Personal data leak
A personal data leak occurred at Zigzag, operated by Kakao Style. A payout of 20,000 points was offered as a response measure, and the scale and cause of the leak have not been disclosed.
Read on 더퍼블릭 ↗Controversy over employee's medical certificate displayed on Dongdaegu Station shared PC
Impact: Employee's hospital medical certificate
Controversy over a personal data leak arose after an employee's hospital medical certificate was displayed on a shared company PC at Dongdaegu Station. The specific timing, scope of exposure and response have not been confirmed.
Read on 영남일보 ↗
Key incidents in other countries
23andMe Breach Leaks Genetic and Personal Data of 6.9 Million Users
6.9mImpact: Ancestry and personal data of about 6.9 million users, and some health and genotype data
In 2023, a credential stuffing attack on 23andMe leaked the ancestry and personal data of about 6.9 million users, and some health information and raw genotype data were also stolen. The attack went undetected for months. Lawsuits and settlements with victims and state governments followed, and in October 2026 the settlements with victims and states were reported to total $70 million.
Related reports: 99 · last report →TSTT cyber-attack exposes customer data, posted on dark web
Impact: Customer information and bank and credit card details
Trinidad and Tobago telecoms operator TSTT suffered a cyber-attack in October 2023 that led to unauthorised access to customer information, which was then posted on the dark web. TSTT isolated the affected systems and brought in outside experts. It later emerged that the intrusion used administrator credentials, and publication of the investigation report was put on hold following legal challenges.
Related reports: 16 · last report →Ransomware at ICBC’s US subsidiary disrupts Treasury trading
Impact: Disruption to some systems of the US financial services subsidiary and to US Treasury trade processing
The US financial services subsidiary of the Industrial and Commercial Bank of China was hit by a ransomware attack, disrupting some systems and the processing of US Treasury trades. The affected systems were isolated, and recovery and investigation were carried out with outside experts and law enforcement. The attackers later claimed to have received a ransom, and counterparties were cautious about resuming trading.
Related reports: 12 · last report →Mr. Cooper cyber-attack exposes data of 14.7 million people
14.7mImpact: Personal information of around 14.7 million people
US mortgage servicer Mr. Cooper was hit by a cyber-attack in October 2023, exposing the personal information of around 14.7 million people. Both current and former customers were affected. A class action was subsequently filed, and in August 2025 a court allowed key claims to proceed.
Related reports: 10 · last report →Cyber-attack on Australian port operator halts terminal operations
Impact: Halt of operations at major port terminals and backlog of 30,000 containers
A major Australian port operator was hit by a cyber-attack that halted operations at major port terminals. The logistics disruption left 30,000 containers stranded at the ports. The ports resumed operations three days after the attack, and cooperation between the government and industry helped limit the damage.
Related reports: 8 · last report →