Week 1, 2025 security incident report

GS Retail leaks personal data of 1.66 million customers

1.7mImpact: Personal data of 1.66 million customers

GS Retail was hit by a credential stuffing attack that leaked customers' personal information. The damage was initially reported at about 90,000 people, but further leaks at GS SHOP emerged, and the confirmed scale was later 1.66 million people. GS Retail apologised and launched a task force with management participation, and the Personal Information Protection Commission imposed a fine of 12.836 billion won.

Korea National University of Arts hack leaks data of around 18,000 people

18kImpact: Personal information of around 18,000 current students and graduates

The Korea National University of Arts was hacked on 29 December 2024, leaking the personal information of around 18,000 current students and graduates. The leaked data included grades, guardian information and bank account details.

KISIA newsletter subscribers' email addresses leaked

10kImpact: Around 10,000 newsletter subscriber email addresses

In January 2025, it emerged that around 10,000 email addresses of newsletter subscribers of the Korea Information Security Industry Association had been leaked. The leak was attributed to human error.

US Treasury breached via remote support service, internal documents accessed

Impact: Unauthorised access to workstations and internal documents; Office of Foreign Assets Control and Office of Financial Research affected

The US Department of the Treasury suffered unauthorised access to workstations and internal documents through a breach of a remote support service. The attackers used an API key stolen from the BeyondTrust remote support service, and the Office of Foreign Assets Control and the Office of Financial Research were also confirmed as affected. The US linked the attack to the China-linked Silk Typhoon group and announced actions against the cyber actors involved, whilst China denied involvement.

Data and location records tied to 800,000 Volkswagen EVs exposed

Impact: Customer information and location data related to around 800,000 electric vehicles

Customer information and location data related to around 800,000 electric vehicles were exposed at Cariad, Volkswagen's software subsidiary. Precise location data for vehicles in Europe was exposed for several months, and a cloud misconfiguration and poor security management of AWS credentials were identified as the cause.

STIIIZY breach exposes ID and purchase data of 380,000 customers

380kImpact: ID information, signatures, purchase histories and more of 380,000 customers

At US cannabis products company STIIIZY, customer information from some shops was exposed in November 2024 after an account at its point-of-sale service supplier was compromised. The exposed data included driving licence and passport numbers, ID photos, signatures and purchase histories, and 380,000 people were reported affected. The company notified customers of the breach, and a related class action was later filed.

Ford's official X account compromised to post pro-Palestinian messages

Impact: Unauthorised pro-Palestinian messages posted on official X account

Ford's official X account was compromised and pro-Palestinian messages were posted, including one calling Israel a terrorist state. Ford confirmed the account had been temporarily compromised and investigated the incident. The specific method of intrusion has not been confirmed.

Tampa General Hospital settles class action over data breach

A data breach at Tampa General Hospital led to a class action lawsuit. The hospital agreed to a $6.8 million settlement in the lawsuit. The date of the incident, the scale of the leak and its cause have not been confirmed.