Week 50, 2024 security incident report
Hacking and data breach incidents newly reported 2024.12.09 ~ 12.15
Six incidents were recorded in South Korea, with a hacker's claim to have stolen 1 million personal data records from iLesson being the largest in terms of the stated scale of damage. The National Credit Union Federation of Korea received a heavy sanction for leaking 184,465 records of members' personal credit information, and personal data leaks were also confirmed at Maeumsarang, G&Co Style and a Taekwang Group savings bank, highlighting data exposure across multiple sectors. At the National Health Insurance Service, a text message chasing payment of arrears leaked one defaulter's mobile phone number to 16 unrelated defaulters, showing that personal data was exposed not only through hacking but also in the course of routine work. Overseas, 38 incidents were recorded, with the Krispy Kreme ransomware attack and the hacking of Rhode Island's welfare system leading to large-scale personal data damage, disrupted online ordering and a shutdown of the public welfare system, while a large-scale data leak at Telecom Namibia and hacks of celebrities' social media accounts also occurred.
By type
- Hacking & intrusion19
- Data breach12
- Ransomware12
- Malware1
Key incidents in South Korea
Hacker claims to have stolen 1 million iLesson personal records
1mImpact: Claimed theft of 1 million personal records
A hacker claimed to have stolen 1 million personal records from the iLesson website. The hacker attempted to sell the data via Telegram, whilst whether a leak actually occurred and the response have not been confirmed.
Read on 보안뉴스 ↗National Credit Union Federation of Korea heavily sanctioned over leak of about 180,000 personal credit records
184.5kImpact: 184,465 personal credit records of members
In 2019, an employee of the National Credit Union Federation of Korea who was due to retire leaked 184,465 personal credit records, including member names, loan account numbers, loan amounts and outstanding balances, by email to an employee of a local credit union. Inadequate internal controls were also found, and the Financial Supervisory Service (FSS) imposed an institutional warning and a fine of 2.872 billion won, amongst other penalties, on the federation.
Read on 뉴시스 ↗NHIS leaks phone number in arrears reminder text
16Impact: Mobile phone number of 1 defaulter leaked to 16 unrelated defaulters
On 30 August 2024, while urging payment of overdue health insurance premiums, the National Health Insurance Service mistakenly sent a text message containing one defaulter's mobile phone number to 16 unrelated defaulters. The victim demanded 16 million won in compensation from the agency.
Read on 뉴스핌 ↗Psychological testing platform Maeumsarang leaks member data
Members' personal information was leaked from the psychological testing platform Maeumsarang. The scale of the leak was not disclosed, and the date, cause and response have not been confirmed.
Read on 보안뉴스 ↗Document forgery and personal data leak at Taekwang Group savings bank
Mismanagement worth 31 billion won, document forgery and a personal data leak came to light at a savings bank affiliated with Taekwang Group. The scale and date of the personal data leak and the follow-up response have not been confirmed.
Read on 비즈중앙 ↗G&Co Style hack leaks names, emails and phone numbers
Impact: Personal information including names, email addresses and phone numbers
Personal information including names, email addresses and phone numbers was leaked from G&Co Style in a hack. The number of people affected, the date of the incident and the specific response have not been confirmed.
Read on 보안뉴스 ↗
Supply-chain breaches
Brain Cipher claims Deloitte data theft; Deloitte denies
The ransomware group Brain Cipher claimed to have stolen data from Deloitte. In response, Deloitte denied claims that its systems had been hacked.
Related reports: 3 · last report →
Also affected: 1- State of Rhode IslandRhode Island welfare system hack affects 657,000 peoplePersonal data of 657,000 people and public welfare system outage
Key incidents in other countries
Krispy Kreme ransomware attack exposes data of over 160,000 people
160kImpact: Information on more than 160,000 people exposed and online ordering disrupted
Krispy Kreme suffered a cyber-attack in November 2024 that resulted in the theft of information on more than 160,000 people and disrupted online ordering. The company later confirmed a data breach caused by a ransomware attack, with current and former employees among those affected. Krispy Kreme reached a $1.6 million settlement in a related class action, with eligible individuals advised that payments could reach up to $3,500 each.
Related reports: 33 · last report →Telecom Namibia cyber-attack leaks data of more than 600,000 people
600kImpact: Information of more than 600,000 Namibians
Telecom Namibia was hit by a cyber-attack that leaked the information of more than 600,000 Namibians. Amupanda claimed that the Namibia Central Intelligence Service was responsible for the attack.
Related reports: 5 · last report →Drake's X account hacked to promote Solana memecoin
Rapper Drake's X account was hacked and abused to promote a fraudulent Solana-based memecoin. Followers were deceived into trading, and the related trading volume reached $5 million.
Related reports: 5 · last report →Tina Knowles says her Instagram account was hacked
Tina Knowles' Instagram account liked a post about the lawsuit accusing Jay-Z of sexual assault. Knowles said she had not liked the post and that her account had been hacked.
Related reports: 4 · last report →Ransomware attack that could have caused loss of life
Concerns were raised that a ransomware attack could have caused loss of life. The United States sanctioned a Chinese cyber security company in connection with the attack and offered a reward for a Chinese hacker involved. The organisation affected, the date of the incident and the actual scale of the damage have not been confirmed.
Related reports: 3 · last report →