Week 27, 2024 security incident report
Hacking and data breach incidents newly reported 2024.07.01 ~ 07.07
Between 1 and 7 July 2024, four new incidents occurred in South Korea, with the leak to an external website of the names, department names and IP addresses of about 3,000 National Election Commission employees, along with PC security inspection scorecards, standing out in terms of scale. The distribution of hacking emails impersonating the National Tax Service during the VAT filing period, the hacking of the social media account of the chair of the National Assembly's Science, ICT, Broadcasting and Communications Committee, and issues with Nexon's response to subscription-based DDoS attacks also emerged, as a variety of security threats were confirmed in public institutions and the gaming industry. Across all types in South Korea and abroad, personal data leaks were the most common at 24, followed by 13 hacking/intrusion cases and 9 ransomware cases. Overseas, ransomware at Patelco Credit Union leaked the information of more than 1 million people and disrupted financial services, the Florida Department of Health saw a leak of medical records and a suspension of online certificate issuance, and knock-on damage from Evolve Bank & Trust to Wise and Affirm was also confirmed.
By type
- Data breach23
- Hacking & intrusion12
- Ransomware8
- Phishing & smishing4
- DDoS1
- Malware1
Key incidents in South Korea
Data of about 3,000 National Election Commission employees leaked to external site
3kImpact: Names, department names, IP addresses and PC security inspection scorecards of about 3,000 employees
During an internal security inspection at South Korea's National Election Commission, a contract worker posted the inspection results to VirusTotal, leaking the data of about 3,000 employees. The leaked data included names, department names, IP addresses and PC security inspection scorecards. The Personal Information Protection Commission (PIPC) received a report on 26 June 2024 and began verifying the facts.
Read on 쿠키뉴스 ↗Phishing emails impersonating South Korea's National Tax Service target VAT filing season
Phishing emails with sender addresses spoofed to the National Tax Service (NTS) domain were circulated in South Korea, targeting the value-added tax filing period. Demanding explanations regarding tax evasion reports, they attempted to steal information by getting recipients to run malicious attachments or log in to fake portal pages. The specific affected organisations and the scale of the damage were not disclosed.
Read on SBS ↗Nexon weighs response to subscription-based DDoS attacks
Nexon is weighing how to respond to DDoS attacks. The emergence of DDoS attacks as a subscription service was raised as a problem.
Read on 바이라인네트워크 ↗Social media account of South Korean parliamentary science and ICT committee chair hacked
The social media account of the chair of the Science, ICT, Broadcasting and Communications Committee of South Korea's National Assembly was hacked. The specific scale of damage, the attack method and the response have not been confirmed.
Read on 중앙일보 ↗
Supply-chain breaches
Evolve Bank & Trust breach exposes data of over 7.64 million people
7.6mImpact: Personal information of 7,640,112 customers and partner service users, including names, Social Security numbers and bank account numbers
Evolve Bank & Trust was hit by a LockBit ransomware attack that compromised the personal information of 7,640,112 customers and users of its open banking partner services. The attackers had had access to the network since at least February 2024 and stole names, Social Security numbers, bank account numbers and more. The bank acknowledged the illegal data theft, and Wise and Affirm also confirmed that their customers had been affected.
Related reports: 13 · last report →
Also affected: 2- WyzeEvolve Bank breach affects some Wise customersSome customers affected
- AffirmEvolve Bank hack exposes Affirm card customer dataData of some customers and cardholders
FromSoftware parent hit by ransomware attack and data leak
Impact: Data leak and possible leak of Spike Chunsoft employees' personal information
The parent company of FromSoftware and Spike Chunsoft was hit by a ransomware attack. The attackers threatened to publish 1.5TB of internal data on 1 July unless a ransom was paid. The parent company later acknowledged a data leak, and it was suggested that personal information of Spike Chunsoft employees may also have been leaked.
Related reports: 4 · last report →
Key incidents in other countries
Patelco Credit Union ransomware attack exposes data of over 1 million
1mImpact: Personal data of more than 1 million people, including customers and staff
A ransomware attack on Patelco Credit Union in California in June 2024 exposed the personal data of customers and staff. The attackers put the stolen data up for auction, and the number of people affected grew from an initial estimate of around 726,000 to more than 1 million. A $7.25 million settlement was subsequently reached in a data breach class action.
Related reports: 13 · last report →Ransomware disrupts financial services at Patelco Credit Union
500kImpact: Disruption of financial services for about 500,000 members and an investigation into a related data breach
US-based Patelco Credit Union was hit by a ransomware attack on 29 June 2024 and shut down some of its banking systems. Online and mobile banking services and some transactions were disrupted, and an investigation was also launched into a data breach affecting about 500,000 members. On 8 July, the credit union said its network had been stabilised.
Related reports: 12 · last report →Florida Department of Health ransomware attack leaks data, halts certificate issuance
Impact: Patient medical records leaked and online issuance of birth and death certificates halted
The Florida Department of Health was hit by a cyber-attack in June 2024 that leaked patient medical records and halted online issuance of birth and death certificates. Ransomware gang RansomHub claimed to have published the stolen data on the dark web. The department processed certificates manually and later notified victims of the incident and offered credit monitoring.
Related reports: 11 · last report →OpenAI internal forum hack leads to theft of AI-related internal information
Impact: Theft of internal information related to artificial intelligence
OpenAI was hacked in 2023, and internal information related to artificial intelligence was stolen. The targets of the attack included an internal forum. OpenAI did not disclose the incident to the public at the time, and it came to light in July 2024.
Related reports: 8 · last report →Life360 leaks user phone numbers through insecure API
442kImpact: Information on 442,000 users exposed
Information including user phone numbers was leaked from family location-tracking app Life360 through an insecure API. In July the number affected was reported as 443,000, while an August follow-up mentioned the exposure of information on 442,000 users. An investigation into potential litigation over the incident was also conducted.
Related reports: 6 · last report →