Week 38, 2024 security incident report
Hacking and data breach incidents newly reported 2024.09.16 ~ 09.22
Two new incidents were confirmed in South Korea between 16 and 22 September 2024, with the leak of more than 113,000 personal data records at Popinborder standing out in terms of scale. There were also signs that a dental practice's website had been hacked and then exploited to sell drugs, meaning both personal data leaks and website misuse were confirmed in South Korea. By incident type overall, 26 personal data breaches and 22 hacking/intrusion incidents dominated, and knock-on damage from Experience Engine to Deloitte was also confirmed. Overseas, 56 new incidents were recorded, with the leak of Star Health customers' health information and the promotion of cryptocurrency scams through hacked accounts and channels standing out, while Temu denied a hacker's claim to have stolen 87 million data records.
By type
- Data breach27
- Hacking & intrusion22
- Ransomware6
- Phishing & smishing2
Key incidents in South Korea
About 113,000 personal data records leaked from Popinborder
113kImpact: About 113,000 personal data records
Some 113,000 personal data records were leaked from Popinborder, an e-commerce marketplace brokerage platform. The timing, cause and response have not been confirmed.
Read on 보안뉴스 ↗Hacked dental surgery website apparently used to sell drugs
Evidence emerged that a dental surgery's website had been hacked and used to sell drugs. The name of the affected surgery, when the incident took place and any response have not been confirmed.
Read on 치의신보 ↗
Supply-chain breaches
Hacker claims breach of UK's Experience Engine and data sale
A hacker claimed to have breached the UK's Experience Engine and to be selling its data online. IntelBroker said it had carried out the Experience Engine hack.
Related reports: 2 · last report →
Also affected: 1
Key incidents in other countries
Star Health customers' health data leaked online in India
Impact: Customer health data leaked
Health data belonging to customers of Indian insurer Star Health was posted online and leaked via Telegram chatbots. Star Health confirmed the data breach in October 2024 and said it had received a $68,000 ransom demand. Having investigated allegations that its head of security was involved, it concluded that he had done nothing wrong.
Related reports: 14 · last report →Usher claims hack after posts vanish from X account
Impact: All posts on the X account deleted
All posts disappeared from singer Usher's X account. Usher claimed that he had not deleted the account himself but had been hacked.
Related reports: 11 · last report →Supreme Court of India YouTube channel hacked to stream crypto promotion videos
Impact: YouTube channel live streams replaced with crypto promotion videos
On 20 September 2024, the Supreme Court of India's YouTube channel was hacked and crypto promotion videos were streamed in place of its usual live broadcasts. The promoted assets included XRP, and the channel was later taken down with services announced to resume.
Related reports: 6 →Temu denies hacker's claim of stealing 87 million data records
87mImpact: Claimed theft of 87 million data records, denied by Temu
A hacker claimed to have stolen 87 million data records from Temu. Temu denied the leak claim in September 2024, and its denial of the same claim was reported again in September 2026.
Related reports: 5 · last report →Multiple X accounts hacked to promote crypto token scam
Impact: Multiple X accounts hijacked and used to promote a cryptocurrency scam
Multiple X accounts were hacked and used to promote a Solana-based cryptocurrency token. The attacks were linked to a pump-and-dump scam involving the $HACKED token, and the hacking of accounts belonging to the UK Attorney General and Neymar also came to light.
Related reports: 5 · last report →