Week 35, 2024 security incident report

FSS begins on-site inspections of Naver Pay and Toss over data leak allegations

Following the data leak controversy at Kakao Pay, allegations of personal data leaks were also raised against Naver Pay and Toss. The Financial Supervisory Service (FSS) widened the scope of its inspection and began on-site inspections of Naver Pay and Toss on 26 August 2024.

Hacking channel targeting private social media accounts emerges

A hacking channel that breaks into private social media accounts has emerged. A secondary school pupil said they had all but given up over the social media hacking.

IntelBroker hacks Korea's disaster safety network testbed

Impact: Release of military-related information, including on Unit 777

IntelBroker hacked a testbed for South Korea's disaster safety communications network. The hacker also released military-related information, including on Unit 777.

Xctdoor backdoor attacks target South Korean defence and manufacturing firms

Evidence emerged of attacks on South Korean defence and manufacturing companies in which malicious routines were inserted into an ERP update programme to install the Xctdoor backdoor. Cases of vulnerable web servers being taken over were also found. North Korea's Andariel was suspected to be behind the attacks.

Map service of schools hit by deepfakes suffers more than 50 DDoS attacks

Impact: More than 50 DDoS attacks

The operator of a South Korean web service showing schools affected by deepfakes said the site had suffered more than 50 DDoS attacks since it went live. The specific duration of outages, the amount of damage and the response have not been confirmed.

Daegu education office leaks teachers' resident registration numbers and other data

Impact: Personal information including teachers' resident registration numbers

Personal information including teachers' resident registration numbers was leaked from the Daegu Metropolitan Office of Education. The leak sparked controversy.

Park'N Fly data breach exposes personal information of about 1 million customers

1mImpact: Personal information of about 1 million customers

Unauthorised access to files covering about 1 million customers at Park'N Fly led to a leak of personal information. The company disclosed the data breach and notified about 1 million customers.

Cyber-attack on Dick's Sporting Goods leaks confidential information

Impact: Confidential information leaked; email and employee account access restricted

Dick's Sporting Goods was hit by a cyber-attack that leaked confidential information. After the attack, the company shut down email and locked employee accounts. The specific scale of the leak and the attack method have not been confirmed.

Fota Wildlife Park cyber-attack prompts customers to cancel cards

Customers were advised to cancel their credit cards after Fota Wildlife Park was hit by a cyber-attack. The park contacted affected customers individually, and Revolut later made a goodwill payment to affected customers.

CBIZ customer data breach: Social Security numbers stolen

Impact: Customer data and Social Security numbers

Customer data was leaked from CBIZ, and hackers stole Social Security numbers. CBIZ disclosed the customer data breach in September 2024. In October, it was reported that lawsuits seeking more than $5 million in damages had been filed over the incident.

Halliburton cyber-attack costs $35 million

Impact: Costs of $35 million

Halliburton was hit by a cyber-attack. The attack came to light in August 2024, and in November the costs incurred from the attack were tallied at $35 million.