Week 34, 2024 security incident report
Hacking and data breach incidents newly reported 2024.08.19 ~ 08.25
In South Korea, the hacking of CareerNet, which leaked more than 1.6 million records of members' personal data, stood out most, bringing large-scale data leaks in the education sector to the fore. The hacking of four South Korean sites by the pro-Palestinian hacker group RipperSec and an intrusion thought to involve LockBit 2.0 encryption were also reported, with data leaks, site compromises and ransomware damage occurring side by side. Across all incident types in South Korea and abroad, personal data breaches were the most common at 18, followed by 16 hacking/intrusion incidents and 9 ransomware incidents. Overseas, ransomware-related operational shutdowns and data theft stood out, including service outages at the Port of Seattle and Seattle-Tacoma International Airport and disruption to business and production at Halliburton and Microchip Technology, while at Toyota, customer and staff data was leaked via a breach at an external supplier.
By type
- Data breach19
- Hacking & intrusion16
- Ransomware8
Key incidents in South Korea
CareerNet hack leaks 1.6 million personal records
1.6mImpact: 1.6 million personal records
CareerNet admitted that 1.6 million personal records were leaked in an attack by the hacker IntelBroker. Concerns about secondary damage were raised after the encryption of the leaked data was broken.
Related reports: 2 · last report →More than 1.6 million member records leaked from Education Ministry's CareerNet
1.6mImpact: More than 1.6 million member records
More than 1.6 million member records were leaked from CareerNet, the Ministry of Education's careers information network. A foreign hacker was named as the culprit.
Read on KBS 뉴스 ↗Pro-Palestinian hacker group RipperSec hacks 4 South Korean sites
Impact: 4 South Korean websites
The pro-Palestinian Muslim hacker group RipperSec has hacked four South Korean websites. The names of the affected sites, the specific damage and response measures have not been confirmed.
Read on 보안뉴스 ↗Breach suspected to involve LockBit 2.0 encryption
A breach incident suspected to involve encryption by LockBit 2.0 occurred. The affected organisation, the date of the incident and the response have not been confirmed.
Read on 보안뉴스 ↗
Key incidents in other countries
Port of Seattle ransomware attack disrupts airport services, data stolen
Impact: Outages in airport baggage, check-in, ticketing and Wi-Fi; flight delays and cancellations; data theft
On 24 August 2024, the Port of Seattle and Seattle-Tacoma International Airport suffered service outages caused by a cyber-attack. System encryption and response measures affected baggage handling, check-in, ticketing and Wi-Fi, leading to flight delays and cancellations. The Port of Seattle later confirmed a Rhysida ransomware attack and data theft, and refused the attackers' demand for payment.
Related reports: 35 · last report →Halliburton ransomware attack disrupts systems and steals data
Impact: Disruption of IT systems and operations, data theft, and related costs and losses of about $35 million
US energy services company Halliburton was hit by a cyber-attack in August 2024 that disrupted its IT systems and business operations. The company took some systems offline, and in September it confirmed that data had been stolen and said it was investigating the scope of the leak. The attack was linked to RansomHub, and related costs and losses were later disclosed at about $35 million.
Related reports: 24 · last report →Ransomware attack disrupts production at Microchip Technology
Impact: Disruption of manufacturing facility operations and order fulfilment; theft of personal information such as employee contact details; costs of US$21.4 million
Microchip Technology was hit by a cyber-attack in August 2024 that disrupted operations at its manufacturing facilities and its order fulfilment. The Play ransomware gang claimed the attack and published data it claimed to have stolen, and the company later confirmed the theft of personal information such as employee contact details. In November, costs related to the attack were tallied at US$21.4 million.
Related reports: 17 · last report →Ransomware disrupts operations at Seattle-Tacoma International Airport
Impact: Internet and IT system outages, flight delays and use of handwritten boarding passes
Seattle-Tacoma International Airport was hit by a cyber-attack in August 2024, causing internet and IT system outages and flight delays. Handwritten boarding passes were used during recovery, and on 29 August it was reported that high-traffic airlines had resumed normal operations. In September, the attack was confirmed to be ransomware.
Related reports: 13 · last report →Toyota customer and employee data leaked via third-party supplier breach
Impact: Customer and employee data; 240GB according to the attacker
Toyota customer and employee data was leaked, and the attacker claimed to have stolen 240GB of data and published it online. Toyota confirmed the data breach and said it had been caused by a breach at a third-party supplier.
Related reports: 9 · last report →