Week 17, 2024 security incident report
Hacking and data breach incidents newly reported 2024.04.22 ~ 04.28
In South Korea, the leak of personal data of 75,676 merchant representatives by a Woori Card employee and the theft of technical data and other material from about 10 defence companies and their partners by North Korean hacking groups were the main stories. The theft of 7,089 credit card records through shopping site payment windows also occurred, as insider data leaks, payment information theft and intrusions targeting defence companies and their partners appeared together. Personal data leaks (29) and hacking/intrusion cases (21) dominated the incident types, and 8 ransomware cases were also recorded. Overseas, harm across a range of sectors was reported, including the possible exposure of information on up to 13.4 million Kaiser Permanente members, leaks of police officers' identities and psychotherapy records, a shutdown of a traffic information service and a cyber-attack on a sewage treatment works.
By type
- Data breach29
- Hacking & intrusion21
- Ransomware8
- Phishing & smishing1
Key incidents in South Korea
Woori Card leaks personal data of around 207,000 merchant representatives
207kImpact: Personal information of around 207,000 merchant representatives
Employees at Woori Card's Incheon Sales Centre accessed and extracted merchant representatives' personal information and distributed it to credit card sales agents. The information leaked between January and April 2024 was used to recruit new customers, and Woori Card apologised after the incident was detected through an internal control channel. Initially reported as approximately 75,000 records, the scale was stated as around 207,000 people during sanction proceedings in November 2026.
Related reports: 17 · last report →North Korean hacking groups steal data from about 10 South Korean defence firms and suppliers
Impact: Technical data and other material stolen from about 10 South Korean defence firms and suppliers
North Korea's Lazarus, Andariel and Kimsuky hacked about 10 South Korean defence companies and their suppliers, stealing technical data and other material. They got in through poorly secured routes such as subcontractors' servers and employees' email. The damage came to light through a police investigation, and the specific scale of the damage was still being determined.
Related reports: 15 · last report →7,089 card records stolen via Korean online shop payment pages
7.1kImpact: 7,089 credit card records
The EvilQueen group inserted phishing windows into the payment pages of Korean online shops and stole 7,089 credit card records. The stolen data was used for fraudulent payments and cashed out through Korean second-hand marketplaces and other channels.
Read on 보안뉴스 ↗
Key incidents in other countries
Kaiser Permanente exposes data of up to 13.4 million members
13.4mImpact: Possible exposure of data of up to 13.4 million members
It was confirmed that member information may have been passed to advertisers and other third parties through tracking tools on Kaiser Permanente's websites. Up to 13.4 million people were affected, and the company notified members of the data leak.
Related reports: 18 · last report →PSNI Data Breach Exposes Officers' Identities
Impact: Leak of personal data including officers' identities
A data breach at the Police Service of Northern Ireland exposed the undisclosed identities of police officers. About 5,000 officers and staff took legal action, and the PSNI was fined £750,000. Compensation totalling £40 million was later paid to staff.
Related reports: 18 · last report →WebTPA Employer Services data breach
A data breach occurred at WebTPA Employer Services. When it occurred, its scale, the cause and the response have not been confirmed.
Related reports: 4 · last report →Cyber-attack knocks out KC Scout traffic information services
Impact: Website, traffic cameras and electronic signs out of service
KC Scout was hit by a cyber-attack that left its website, traffic cameras and electronic signs out of service. The outage continued on 26 April. The specific attack method and recovery measures have not been confirmed.
Related reports: 4 · last report →Finnish psychotherapy records hack exposes patients' secrets online
Impact: Patients' psychotherapy records and sensitive secrets exposed online
Psychotherapy records in Finland were hacked, exposing patients' sensitive secrets online. A Finnish hacker involved in the patient records hack was sentenced to prison.
Related reports: 3 · last report →