Week 48, 2023 security incident report
Hacking and data breach incidents newly reported 2023.11.27 ~ 12.03
Between 27 November and 3 December 2023, three new incidents were confirmed in South Korea, with a ransomware attack on Golfzon that leaked the personal data of about 2.21 million users and employees, along with some resident registration numbers and bank account numbers, standing out for the number of people affected. In the hacking of the South Korean courts' computer network, 1,014 GB of data was leaked and personal data of 17,998 people was found in the recovered material, and with 30 articles it attracted the most coverage of any incident in South Korea. A case of photos being leaked by a mobile phone repair employee was also reported, while in the overall tally by type, ransomware was the most common at 21, followed by 14 personal data leaks and 12 hacking/intrusion cases. Overseas, 45 new incidents were confirmed; ransomware attacks on US hospitals disrupted operations at affiliated medical facilities and led to emergency patient transfers and ambulance diversions, while account takeovers at the Japan Aerospace Exploration Agency, a breach of a US water utility and a leak of personal data of about 2 million people through a Dollar Tree third-party supplier were also reported.
By type
- Ransomware18
- Data breach14
- Hacking & intrusion11
- Phishing & smishing1
Key incidents in South Korea
Korean Courts' Network Hacked, Personal Data of 17,998 People Leaked
18kImpact: 1,014 GB of data leaked; personal data of 17,998 people identified in the restored material
The courts' computer network was attacked from 2022 to early 2023, and 1,014 GB of data from the electronic litigation server was leaked externally. Personal data of 17,998 people was identified in the 4.7 GB that was restored, and the attacker was presumed to be North Korea's Lazarus. The National Court Administration said it would notify victims and replace the system entirely, and the Personal Information Protection Commission imposed a fine of 207 million won for inadequate security measures.
Related reports: 30 · last report →Golfzon ransomware attack exposes personal data of about 2.21 million people
2.2mImpact: Personal information of about 2.21 million users and employees, including resident registration numbers of 5,831 people and account numbers of 1,647 people
On 23 November 2023, Golfzon suffered a ransomware attack that damaged part of its server disks, disrupting its app, web and reservation services. It completed emergency recovery after replacing the servers, but later confirmed that files containing members' personal information had been leaked and apologised. An investigation confirmed that access to a file server through a stolen VPN account led to the exposure of personal information of about 2.21 million users and employees.
Related reports: 18 · last report →Photo leaks by phone repair staff prompt KCC prevention measures
Concerns were raised about photos being leaked by mobile phone repair staff. The Korea Communications Commission moved to prevent mobile phone data leaks.
Read on 뉴시스 ↗
Supply-chain breaches
Ardent Health Services ransomware attack disrupts hospital operations
Impact: Disrupted hospital operations in several US states and ambulance diversions
Ardent Health Services suffered a ransomware attack that disrupted hospital operations in several US states and forced ambulances to be diverted to other hospitals. The company disclosed the IT security incident and fully restored its patient portal. It later filed a data breach notification.
Related reports: 11 · last report →
Also affected: 1- Hackensack Meridian Mountainside Medical CenterMountainside Medical Center diverts emergency patients amid ransomware attackDiversion of emergency patients
Ransomware attack forces hospitals in several US states to divert emergency patients
Impact: Disruption to emergency patient intake at hospitals in at least 4 US states
A hospital chain spanning several US states was hit by a ransomware attack, disrupting its systems and A&E operations. Hospitals in at least 4 states diverted emergency patients and ambulances to other medical facilities. Some emergency departments resumed services on 29 November.
Related reports: 11 · last report →
Also affected: 2- The University of Kansas Health System St. Francis CampusUniversity of Kansas Health System St. Francis Campus hit by ransomwareDisruption to medical services and emergency department operations
- UT Health East TexasUT Health East Texas hospital disruption confirmed as ransomwareDisruption to hospital operations
General Electric investigates claims of cyber-attack and data theft
General Electric investigated claims of a cyber-attack targeting the company and of data theft. Whether a breach actually occurred, the scale of the damage and when it happened have not been confirmed.
Read on BleepingComputer ↗
Also affected: 1- Defense Advanced Research Projects Agency (DARPA)GE hacking claim raises suspicions of DARPA-related military data theftTheft of DARPA-related military information and files claimed; actual exposure and its extent unconfirmed
Key incidents in other countries
MGM Resorts' 2023 cyber-attack caused operational disruption and data breach
MGM Resorts suffered operational disruption in Las Vegas from a 2023 cyber-attack, which led to disputes over the data breach. The FBI disrupted the BlackCat ransomware gang used in the attack and created a decryption tool. In December 2025, payments began under a $45 million data breach settlement.
Related reports: 17 · last report →Ardent Health Services ransomware attack disrupts hospital operations
Impact: Disrupted hospital operations in several US states and ambulance diversions
Ardent Health Services suffered a ransomware attack that disrupted hospital operations in several US states and forced ambulances to be diverted to other hospitals. The company disclosed the IT security incident and fully restored its patient portal. It later filed a data breach notification.
Related reports: 11 · last report →Ransomware attack forces hospitals in several US states to divert emergency patients
Impact: Disruption to emergency patient intake at hospitals in at least 4 US states
A hospital chain spanning several US states was hit by a ransomware attack, disrupting its systems and A&E operations. Hospitals in at least 4 states diverted emergency patients and ambulances to other medical facilities. Some emergency departments resumed services on 29 November.
Related reports: 11 · last report →Repeated hacks at Japan Aerospace Exploration Agency and executive accounts compromised
Impact: Compromise of the accounts of the agency head and other directors; possible leak of information on about 40 companies
The Japan Aerospace Exploration Agency was hit by a cyber-attack in the summer of 2023, and attacks continued afterwards. Authorities said there had been no access to rocket or satellite information and no theft of sensitive information, but the possibility of a leak of information on about 40 companies was raised. In October 2024, it was also reported that the accounts of the agency's head and other directors had been compromised.
Related reports: 11 · last report →Water utility hacks across multiple US states and default password weakness
Impact: Breaches of multiple water utilities and organisations across several US states
A water authority near Pittsburgh, Pennsylvania in the US was hit by a cyber-attack, prompting an investigation by federal authorities. It was later confirmed that breaches by Iran-linked hackers had occurred across water utilities and organisations in multiple states. Cyber security authorities said the water utilities had been hacked while still using the default password 1111.
Related reports: 9 · last report →