Week 43, 2024 security incident report
Hacking and data breach incidents newly reported 2024.10.21 ~ 10.27
Between 21 and 27 October, six incidents were recorded in South Korea, with controversy over whether the official responsible for a personal data leak affecting 1.35 million people would be promoted emerging as the issue linked to the largest scale of damage. Personal data damage in the online shopping and marketing sectors stood out, including the viewing and downloading of information on around 290,000 members of Neopharm and Ilhak shopping malls and the sending of around 440,000 illegal text messages, and the leak of 150,000 personal data records from Dream Insight's DB Rich, while a golf booking app data leak and the hacking of personal social media accounts were also confirmed. By type overall, personal data breaches numbered 26, more than the 19 hacking/intrusion incidents and 2 ransomware incidents, and knock-on damage related to MML Investors Services was also recorded. Overseas, 41 incidents occurred, with the leak of personal data of 57 million Hot Topic customers standing out in scale, while allegations of the sale of information hacked from Italian government databases and Russian intelligence's hacking of Georgian government bodies and companies also emerged as key issues.
By type
- Data breach24
- Hacking & intrusion19
- Ransomware2
Key incidents in South Korea
Former APRIL member Lee Hyun-joo's personal social media account hacked
Impact: Personal social media account hacked
Lee Hyun-joo, a former member of APRIL, said her personal social media account had been hacked. She revealed it was the second time she had been hacked and expressed fear.
Related reports: 2 · last report →Personal data leaked from golf booking app Golfmon
Personal data was leaked from the golf booking app Golfmon. Golfmon said it was taking action in accordance with legal procedures and guidance from the Korea Internet & Security Agency (KISA).
Related reports: 2 →Controversy over possible promotion of official responsible for leak of 1.35 million people's data
1.4mImpact: Personal data of 1.35 million people
Whether the official responsible for a leak of 1.35 million people's personal data would be promoted was raised as an issue. The affected organisation, the timing and cause of the leak, and the response have not been confirmed.
Read on 세이프타임즈 ↗Data of about 290,000 Neopharm and Ilhak online shop members leaked
440kImpact: Information of about 290,000 members viewed and downloaded; about 440,000 illegal text messages sent
In August 2023, a hacker used an obtained administrator account to access the online shop 750 times over about two weeks, viewing and downloading the information of about 290,000 members and sending about 440,000 illegal text messages. The investigation found a lack of additional authentication and access restrictions, account sharing and delayed breach notification. Neopharm and Ilhak were fined 120 million won in connection with the personal data leak.
Read on 연합뉴스 ↗150,000 personal records leaked from Dream Insight's DBRich
150kImpact: 150,000 personal records
150,000 personal records were leaked from Dream Insight's DBRich. The timing of the incident, cause of the leak and response measures have not been confirmed.
Read on 민주신문 ↗Court rules opening pharmacy next door using former workplace's information breached trade secrets
A court ruled that opening a pharmacy right next door using information from the pharmacy where the person had worked constituted trade secret infringement. The name of the pharmacy, the specific extent of the damage and when the information was used have not been confirmed.
Read on 약사공론 ↗
Key incidents in other countries
Personal data of 57 million Hot Topic customers leaked
57mImpact: Personal information of 57 million customers
Customer personal information was leaked at Hot Topic, and follow-up checks put the number affected at 57 million. Initial claims said personal and payment information of 350 million people had been exposed. Breach notification service Have I Been Pwned notified 57 million people of the breach.
Related reports: 8 · last report →Italy probes alleged sale of data hacked from government databases
800kImpact: Alleged compromise of information on about 800,000 citizens
Allegations surfaced in Italy that information obtained by hacking government and security databases had been sold to wealthy clients and used to compile illegal dossiers on individuals. It was alleged that about 800,000 citizens had been affected, and dozens of people came under investigation.
Related reports: 6 · last report →Russian intelligence hacked Georgian government agencies and companies
Impact: Breaches of government ministries, the central bank, the Central Election Commission and several companies
Russian intelligence hacked and surveilled Georgia's government ministries, central bank, Central Election Commission and several companies from 2017 to 2020. The intrusions were identified as being aimed at the potential sabotage of critical infrastructure.
Related reports: 5 · last report →Juventus X account hacked to post fake signing announcement
Impact: Fake announcement of Arda Güler signing on X account
Juventus's X account was hacked and a fake post announcing the signing of Real Madrid midfielder Arda Güler was published. Juventus said its account had been hacked and denied signing Güler.
Related reports: 4 →Litigation investigation launched into General Physician data breach
An investigation with a view to litigation was carried out into the General Physician personal data breach. The timing of the breach, its scale and response measures have not been confirmed.
Related reports: 4 · last report →