Week 5, 2024 security incident report

Signs of hacking found at about 100 South Korean universities, hospitals and other sites

Impact: Signs of hacking at about 100 South Korean websites; leak of transcripts, staff photos, internal approval documents and more

Signs of hacking were found on the websites of about 100 South Korean universities, hospitals and clinics, small and medium-sized businesses and local authority-affiliated bodies, and student transcripts, staff photos and internal approval documents were leaked. Police investigated the possibility that Chinese hackers were responsible and that the damage spread through the compromise of shared hosting servers. A suspected hack of the personal information of 110,000 school staff and pupils in Incheon also came under investigation.

Tampered GetAmped spectator feature disrupts gameplay

Impact: Disrupted gameplay for players and around 11 hours of emergency maintenance

Tampering with GetAmped's spectator feature disrupted players' games. Around 11 hours of emergency maintenance were carried out, and operator JUNINTER took steps to prevent use of the tampered spectator feature.

KB Kookmin Card impersonation phishing abuses device-linking feature

An attack was identified in which text messages impersonating KB Kookmin Card card-issuance and payment notices lured victims into contacting fake customer service centres and installing remote-control programs and malicious apps. By abusing stolen accounts and smartphones' feature for linking other devices, the attackers were able to maintain access even after the apps had been deleted.

GetAmped undergoes emergency maintenance amid server hacking suspicions

Suspicions of a server hack were raised at the online action game GetAmped, and emergency maintenance was carried out. Whether a hack actually took place and the extent of any damage have not been confirmed.

Identity verification hacking raises security concerns at South Korea's three mobile operators

Identity verification breaches by hackers and security problems at South Korea's three major mobile operators were raised. The specific method of intrusion, the extent of the damage, when it occurred and the response measures have not been confirmed.

Teenager who hacked online bookshops and cram school referred to youth court

Impact: Unauthorised acquisition of decryption keys for a total of more than 2.15 million e-books and distribution of about 700 lecture videos

A teenager who hacked online bookshops and a university entrance exam cram school, stole e-book decryption keys and lecture videos, and demanded money was referred to the juvenile division of the family court. The teenager was found to have obtained without authorisation decryption keys corresponding to more than 720,000 e-books and more than 1.43 million e-books from another bookshop, and to have distributed about 700 lecture videos.

Cyber-attack takes down network at Chicago's Lurie Children's Hospital

Impact: Systems and network outage and disruption to access to care

Lurie Children's Hospital in Chicago, United States, suffered a cyber-attack and took its systems and network offline. As the network outage lasted for weeks, parents struggled to get care for their children. The hospital confirmed the attack was by a known criminal threat actor and, as of 8 February, had not given a timeline for recovery.

Ransomware attack disrupts administrative and court operations in Fulton County, US

Impact: Disruption of online systems, court operations and other services

In January 2024, Fulton County, Georgia, in the United States, was hit by a cyber-attack that disrupted its online systems and court operations, amongst other services. LockBit claimed the ransomware attack and threatened to release stolen documents, whilst the county worked to restore its systems. County leaders said an employee's mistaken click led to the attack, and the official in charge refused to pay a ransom of millions of dollars.

Schneider Electric's sustainability business hit by ransomware

Schneider Electric's sustainability business division was hit by a ransomware attack in January 2024. The company confirmed the attack on the division, which was linked to the Cactus ransomware.

Cloudflare internal system breach exposes source code

Impact: Access to source code and internal documents; internal wiki and bug database affected

Cloudflare's internal Atlassian systems were breached around Thanksgiving 2023. The attacker, believed to be state-sponsored, used credentials and authentication tokens stolen in the earlier Okta breach to access source code and internal documents, and the internal wiki and bug database were also affected. In its response, the company rotated about 5,000 production credentials.

AnyDesk resets passwords after production server breach

Hackers breached the production servers of remote desktop software company AnyDesk. AnyDesk carried out a broad reset of passwords and credentials and said the software was safe to use afterwards. The specific extent of the customer data compromise has not been confirmed.