Week 25, 2024 security incident report

Daejeon Sun Hospital website hack leaks member personal data

Impact: Members' names, dates of birth, user IDs, passwords, email addresses and phone numbers

Younghoon Medical Foundation became aware on 19 June 2024, after being notified by police, that the Daejeon Sun Hospital website had been hacked. Members' names, dates of birth, user IDs, passwords, email addresses and phone numbers were leaked, and the specific scale of the damage was not disclosed. The hospital advised members to change their passwords.

Sungsimdang online shop hack leaks customer personal data

Impact: Customer personal information

In June 2024, Sungsimdang's online shop was hacked and customers' personal information was leaked. Sungsimdang initially said no personal information had been leaked, but the leak later came to light. The scale of the damage was not known at the time.

Dozens of South Korean SMS resellers hacked to send phishing texts

Impact: Dozens of South Korean SMS resellers hacked and phishing texts sent in bulk

Dozens of SMS resellers in South Korea were hacked and exploited to send phishing text messages in bulk. The attackers infiltrated bulk messaging systems and sent messages without the companies' knowledge. The Korea Internet & Security Agency (KISA) confirmed the damage, and the government launched urgent on-site inspections.

KT accused of spreading malware to PCs of web hard drive users

Impact: Estimated several hundred thousand web hard drive customers affected

KT came under police investigation over allegations that in 2020 it spread malware to the PCs of customers using web hard drive services. The number of victims was estimated at several hundred thousand, and police investigated it as an organised act with separate roles for development, distribution and interception. KT claimed it was a network management response to control malicious grid services and that only a small number of people were involved.

Seoyon E-Hwa employee data leaked, signs of dark web sale

Impact: Data including employee information

In June 2024, a post offering data from Seoyon E-Hwa, a parts supplier to Hyundai Motor and Kia, appeared on the dark web. It later emerged that employee information had been leaked by a ransomware group. The specific scale of the damage and the response were not confirmed.

SK Communications' Nate and Cyworld data breach revisited

SK Communications' Nate and Cyworld personal data breach has been revisited for the lessons it offers. The date of the incident, the scale of the leak, its cause and the response at the time have not been confirmed.

DDoS attack attempts on 22 South Korean government websites detected

Attempted DDoS attacks targeting 22 South Korean government websites were detected. Claims were made that Russian hackers were behind them; whether services were actually disrupted and how authorities responded have not been confirmed.

Row over Ministry of Education passing complainant's information to audited body

Impact: Complainant's information

A row over a personal data leak arose after the Ministry of Education passed a complainant's information to a body under its audit. Claims that it was a leak of personal data clashed with the position that it was normal administrative handling; the scope of the information and any follow-up measures have not been confirmed.

Hacking group claims theft of internal data from Hyundai Motor supplier

A hacking group claimed to have stolen internal data from a Hyundai Motor supplier. The name of the supplier identified as the victim and the amount of data were not confirmed.

Investigation into hacker ring that built personal data database

An investigation was conducted into a ring of hackers who compiled personal information into a database. The case was covered in connection with the rise in spam text messages.

CDK Global ransomware causes widespread outages at North American car dealerships

Impact: Operations disrupted at more than 15,000 car dealerships in North America

In June 2024, CDK Global shut down its dealership management software after a cyber-attack, disrupting more than 15,000 dealerships in North America. The outage was found to have been caused by a BlackSuit ransomware attack, and some dealerships processed work by hand. While the service outage continued, the attackers demanded millions of dollars, and affected dealerships filed lawsuits.

Evolve Bank & Trust breach exposes data of over 7.64 million people

7.6mImpact: Personal information of 7,640,112 customers and partner service users, including names, Social Security numbers and bank account numbers

Evolve Bank & Trust was hit by a LockBit ransomware attack that compromised the personal information of 7,640,112 customers and users of its open banking partner services. The attackers had had access to the network since at least February 2024 and stole names, Social Security numbers, bank account numbers and more. The bank acknowledged the illegal data theft, and Wise and Affirm also confirmed that their customers had been affected.

Ransomware attack on car dealership software disrupts North American sales

Impact: Disruption of sales and computer operations at US and Canadian car dealerships

A cyber-attack on a car dealership software provider disrupted vehicle sales at dealerships in the United States and Canada. Some dealerships kept operating by filling out paperwork with pen and paper, and the attackers demanded a ransom of millions of dollars. The disruption continued until 2 July, and most affected dealerships expected to resume online operations by 4 July.

CDK Global ransomware attack disrupts car dealerships

Impact: Disruption to system access and business operations at about 15,000 car dealerships

A cyber-attack on CDK Global on 19 June 2024 disrupted system access and business operations at about 15,000 car dealerships. Outages from the ransomware attack lasted several days, and CDK Global later notified the US state of Maine of a data breach related to the attack.

Rapper 50 Cent's X account hacked for crypto scam

Impact: 50 Cent's X account hijacked; hackers' earnings claimed at $3 million

Rapper 50 Cent's X account was hacked and used for a cryptocurrency scam. 50 Cent said he had no connection to the cryptocurrency and initially claimed the hackers made $300 million in 30 minutes. The figure he claimed for the hackers' earnings was later reported as $3 million, and the actual losses were not confirmed.