Week 47, 2024 security incident report

342,000 ether stolen in Upbit hack

Impact: 342,000 ether, worth about 58 billion won at the time

In 2019, 342,000 ether, worth about 58 billion won at the time, were stolen from Upbit. In November 2024, police announced the results of their investigation, concluding that the North Korean hacking groups Lazarus and Andariel were responsible. Some of the assets were recovered through cooperation with Switzerland.

North Korea confirmed behind theft of 58 billion won in virtual assets

Impact: 58 billion won in virtual assets

A theft of virtual assets worth 58 billion won occurred. Police concluded that North Korea was behind the incident, marking the first confirmed case of damage in South Korea from North Korean theft of virtual assets.

Administrator account credentials of university hospitals, city halls and other public bodies hacked

Impact: Administrator account credentials of public institutions including university hospitals and city halls

Administrator account credentials of public institutions, including university hospitals and city halls, were hacked. The names of the affected institutions, the extent of the damage, the intrusion route and the response have not been confirmed.

Ransomware group RA Group claims theft of 700GB of SK Gas data

Impact: Claimed theft of 700GB including employees' personal information and departmental data

Ransomware group RA Group claimed to have stolen 700GB of SK Gas data, including employees' personal information and departmental data. Whether the data was actually stolen, the date of the incident and SK Gas's response have not been confirmed.

Smilegate leaks personal data during Lost Ark art book sale

Personal information was leaked during Smilegate's sale of a Lost Ark art book. The scale of the leak, its specific cause, when it occurred and the response measures have not been confirmed.

I Am Solo series 22 cast member Ok-soon hacked, vows to respond

Ok-soon, a cast member of series 22 of I Am Solo, was hacked. Ok-soon said she would not stay silent and expressed her intention to respond.

Bank book copies left on community centre copier

Copies of bank books were left unattended on a multifunction copier at an administrative welfare centre, revealing a risk of personal information exposure. The specific institution, the actual scale of any leak and the response measures have not been confirmed.

Hacked home and classroom webcams used to livestream footage

Impact: Livestreaming of footage from home and classroom webcams

Webcams in homes and classrooms were hacked and used to livestream footage. The specific scale of the damage, the time of occurrence and the response have not been confirmed.

Blue Yonder ransomware attack disrupts retailers' logistics and workforce management

Impact: Operational disruption including Starbucks workforce management and UK retailers' logistics and warehouse systems

Blue Yonder discovered a ransomware attack on 21 November 2024, causing cascading disruption to customer operations. Retailers' operations were affected, including employee hours and rota management at Starbucks and fresh food warehouse management at Morrisons. When the ransomware group Termite claimed the attack and the theft of 680GB of data, Blue Yonder investigated the claims.

Finastra file transfer system breach exposes personal data

800kImpact: Personal information and Social Security numbers of more than 800,000 Americans exposed

Finastra's internal SFTP system was breached in an attack using stolen credentials, leading to a leak of personal information. The company detected suspicious activity on 7 November 2024 and isolated the platform, while the attacker claimed to be selling 400GB of data. The company began notifying victims in February 2025, and in July it was reported that more than 800,000 Americans had been affected.

Stop & Shop cyber-attack disrupts product supply ahead of Thanksgiving

Impact: Product supply disruption and empty shelves at some stores

Affected by a cyber-attack, Stop & Shop suffered product supply disruptions in November 2024 ahead of Thanksgiving, including empty shelves at some stores. The disruption continued until 22 November, and a return to normal operations was expected on the same day.

Hannaford restores online services disrupted by cyber-attack

Impact: Online service outage

Hannaford was hit by a cyber-attack that disrupted its online services. On 19 November 2024, it was reported that online services were working normally again.

Gandara Mental Health Center data breach affects more than 20,000 clients

20kImpact: More than 20,000 clients

A data breach at Gandara Mental Health Center affected more than 20,000 clients. The centre later settled a class action over the incident.