Week 51, 2024 security incident report
Hacking and data breach incidents newly reported 2024.12.16 ~ 12.22
Between 16 and 22 December, the incident that attracted the most attention in South Korea, with 13 articles, was the hacking of Stibee's servers, which leaked members' personal data and some members' credit information. At Simmtech, ransomware encrypted some production systems and data, and the attack group claimed to have stolen around 745 GB of internal data, while at an agency under the Ministry of Education, the phone numbers of 957 teachers researching AI textbooks were leaked. Across all types, 22 personal data breaches and 19 hacking/intrusion incidents stood out, and in South Korea, too, data leaks and damage to production systems occurred together. Overseas, the leak of data on around 1.46 million patients at Texas Tech University Health Sciences Center and administrative disruption from an attack on Ukraine's state registry systems occurred, and knock-on damage from Blue Yonder to Starbucks, Morrisons and Waterstones was also confirmed.
By type
- Data breach23
- Hacking & intrusion18
- Ransomware8
- Malware2
- Phishing & smishing1
Key incidents in South Korea
Stibee server hack leaks members' personal and credit information
Impact: Members' names, email addresses and encrypted passwords, and some members' credit information
On 17 December 2024, the servers of newsletter platform Stibee were hacked, leaking members' names, email addresses and encrypted passwords, as well as some members' credit information. The incident also led to spam emails impersonating South Korea's Ministry of Foreign Affairs. Stibee announced follow-up measures including blocking the illegal access route, introducing two-factor authentication and destroying temporarily retained credit information, and the Personal Information Protection Commission (PIPC) launched an investigation.
Related reports: 13 · last report →Simmtech ransomware attack encrypts some production systems and data
Impact: Some production systems and data encrypted; attackers claim to have stolen about 745GB of internal data
Simmtech said that some of its production systems and data were encrypted in a ransomware attack on 9 November 2024, and that it recovered within two to three days. In December, the ransomware group Underground claimed to have stolen about 745GB of internal data and released items including the chairman's passport photo and tax-related documents.
Related reports: 3 · last report →Phone numbers of 957 AI textbook research teachers leaked from agency under South Korea's Education Ministry
957Impact: Phone numbers of 957 AI textbook research teachers
The phone numbers of 957 teachers involved in AI textbook research were leaked from an agency under South Korea's Ministry of Education. The name of the agency, the cause of the leak, the date of the incident and the response have not been confirmed.
Read on 경향신문 ↗10 years after the KHNP hack, North Korean cyber-attacks continue
The Korea Hydro & Nuclear Power hacking incident marked its 10th anniversary in 2024. North Korean cyber-attacks are continuing, and the specific scale of damage and response to the incident have not been confirmed.
Read on 보안뉴스 ↗
Supply-chain breaches
Blue Yonder ransomware attack disrupts retailers' logistics and workforce management
Impact: Operational disruption including Starbucks workforce management and UK retailers' logistics and warehouse systems
Blue Yonder discovered a ransomware attack on 21 November 2024, causing cascading disruption to customer operations. Retailers' operations were affected, including employee hours and rota management at Starbucks and fresh food warehouse management at Morrisons. When the ransomware group Termite claimed the attack and the theft of 680GB of data, Blue Yonder investigated the claims.
Related reports: 14 · last report →
Also affected: 2- MorrisonsBlue Yonder cyber-attack hits Morrisons supply chainSupply chain operations affected
- Waterstones Booksellers LimitedBlue Yonder ransomware attack hits Waterstones warehouse systemsWarehouse system operations affected
Key incidents in other countries
Texas Tech Health Sciences Center breach exposes data of about 1.46 million patients
1.5mImpact: Personal information and medical records of about 1.46 million patients; $2 million in costs and a separate loss of revenue
Texas Tech University Health Sciences Center was hit by a ransomware attack that leaked patients' personal information and medical records. In December 2024, the number of people affected was reported as about 1.46 million. In February 2025, it was disclosed that incident response costs had reached $2 million and that the centre had also suffered a separate loss of revenue.
Related reports: 9 · last report →Meta's 2018 security breach leaked data from 29 million Facebook accounts
Impact: Information from 29 million Facebook accounts leaked
A 2018 security breach at Meta leaked information from 29 million Facebook accounts. The victims included about 3 million users in the European Union. In December 2024, Meta was fined 251 million euros in connection with the incident.
Related reports: 9 · last report →Cyber-attack on Ukraine's state registers disrupts administration
Impact: Disruption of vehicle ownership transfers, marriage registrations and property transactions
Ukraine's state registers were hit by a massive cyber-attack, disrupting vehicle ownership transfers, marriage registrations and property transactions. Ukrainian authorities named Russia as the perpetrator. The state registers were later restored.
Related reports: 7 · last report →Unauthorised access to Pembina Trails School Division pupil data database
Impact: Unauthorised access to a database containing pupils' personal information
Pembina Trails School Division said a cyber-attack had resulted in unauthorised access to a database containing pupils' personal information. The number of affected pupils, the specific types of information and the response have not been confirmed.
Related reports: 6 · last report →Wood County in the US pays $1.5 million over ransomware attack
Impact: $1.5 million paid in ransomware response
Wood County, Ohio, was hit by a ransomware attack in December 2024. The county paid $1.5 million to resolve the attack. Subsequently, in January 2025, the county's IT director resigned.
Related reports: 4 · last report →