Week 33, 2024 security incident report

KakaoPay provided data of 40.45 million users to Alipay

40.5mImpact: Personal credit information of 40.45 million users

KakaoPay was cited by the Financial Supervisory Service for providing the personal credit information of 40.45 million users to China's Alipay without consent. The transferred data included account identifiers, contact details, sign-up information and transaction histories, whilst KakaoPay countered that it was a lawful outsourcing of business operations. A request for materials from the Personal Information Protection Commission and a police investigation followed, and a court ruled that a fine of about 6 billion won was justified.

Hanon Systems hit by ransomware hack, employee data published

Impact: Employee data and other material published

In August 2024, Hanon Systems was hacked by the Hunters International ransomware group, and employee data and other material were published. The specific scale of the damage and the response have not been confirmed.

Newstapa YouTube account hacked, channel altered and videos made private

1.3mImpact: Channel with 1.33 million subscribers altered and videos posted over 12 years made private

On the night of 16 August 2024, an unauthorised login occurred on Newstapa's YouTube account. The name and logo of the channel, which has 1.33 million subscribers, were changed to Tesla, and videos posted over 12 years were made private. Newstapa changed its password and restored the channel and videos.

Contractor's update error at Sun Moon University leaks student data

9.7kImpact: More than 9,700 records of student personal information

More than 9,700 records of student personal information were leaked at Sun Moon University. The cause was an update error by a contractor; the date of the incident and specific response have not been confirmed.

High school student hacks course registration system, leaking data of 559 students

559Impact: Personal information of 559 students and 559 course registration forms; unauthorised cancellation of other students' registrations

A high school student hacked the course registration system of a hub school under the high school credit system, cancelled other students' course registrations and downloaded 559 course registration forms without authorisation. The forms contained students' names, contact details, addresses, dates of birth, schools and guardians' names, among other information. The timing of the incident and response measures have not been confirmed.

Personal data of 353 teachers exposed on KERIS Jisiksaemteo platform

353Impact: Names, affiliations, user IDs and phone numbers of 353 teachers

The names, affiliations, user IDs and phone numbers of 353 teachers who had applied for school-level courses on the Korea Education and Research Information Service's Jisiksaemteo platform were exposed in Google search results. The problem was identified on 8 August 2024, following reports from teachers. The operator said it completed corrective measures about six hours after becoming aware of the issue.

Student personal data leaked at university in Asan, South Chungcheong

Student personal information was leaked at a university in Asan, South Chungcheong Province. The name of the university, the scale of the leak, the timing of the incident and response measures have not been confirmed.

Moasis ransomware infection paralyses book orders and deliveries

Impact: Publishing orders and deliveries paralysed

Moasis was infected with ransomware, paralysing publishing orders and deliveries. The date of the incident and specific response measures have not been confirmed.

Covenant Health ransomware attack affects over 470,000 people

478.2kImpact: 478,188 people affected by the data breach

Covenant Health suffered a ransomware attack in 2025 that caused connectivity disruptions across the organisation, including its hospitals. The number of people affected by the data breach was later tallied at 478,188. Covenant Health agreed to a $2 million settlement in a class action lawsuit related to the incident.

X's Trump-Musk livestream glitches and DDoS claim

Impact: Access problems with the Trump-Musk live conversation

Donald Trump and Elon Musk's live conversation on X suffered access problems and technical issues. Musk claimed a massive DDoS attack was the cause. It is not known whether an attack was confirmed.

Polish Anti-Doping Agency hacked, athlete data leaked

Impact: Athlete data leaked

The Polish Anti-Doping Agency was hit by a cyber-attack and athlete data was leaked. Suspicions were raised that Russia, Belarus or a hostile state was behind it. The agency said the leaked doping test results were fake, and the specific extent of the damage and the date of the incident have not been confirmed.

CareSpring breach exposes personal and medical data of about 77,000 patients

77kImpact: Personal and medical information of about 77,000 patients

A data breach at CareSpring Healthcare Management exposed the personal and medical information of about 77,000 patients. An investigation with a view to a data breach lawsuit was launched in connection with the incident.

Enzo Biochem data breach in ransomware attack

Enzo Biochem suffered a data breach in a ransomware attack. The company agreed to pay $4.5 million in connection with the cyber-attack. A $7.5 million settlement was later also reached in a data breach class action.