Week 11, 2025 security incident report
Hacking and data breach incidents newly reported 2025.03.10 ~ 03.16
Between 10 and 16 March 2025, four incidents were recorded in South Korea, with the Incruit hack, which leaked the personal data of around 7.3 million people and some users' CV information, standing out most in terms of both scale and coverage. The legal aftermath of large-scale leaks also drew attention, including zero won in damages awarded over Meta's leak of personal data of 3.3 million people and a 750 million won fine for a travel agency's leak of personal data of 3.06 million people. With an investigation into suspected personal data theft by a site impersonating Air Busan, South Korean incidents were concentrated on personal data leaks and theft, and in the overall tally by type, personal data breaches were also the most common at 22. Overseas, 33 incidents were recorded, with a large-scale X outage and claims of a DDoS attack, a 350 GB data leak at Jaguar Land Rover, and successive data leaks at Allstate and its affiliates standing out.
By type
- Data breach22
- Hacking & intrusion6
- Ransomware6
- DDoS1
- Phishing & smishing1
- Malware1
Key incidents in South Korea
Incruit hack leaks personal data of about 7.3 million people
7.3mImpact: Personal data of about 7.3 million people and CV information of some users
Incruit was attacked by external hackers from 19 January to 4 February 2025, leaking the personal data of about 7.3 million people. The data included names, genders and mobile phone numbers, and for some users, education, work history, personal statements, qualifications, training history and awards. The Personal Information Protection Commission (PIPC) launched an investigation and in October imposed a fine of KRW 463 million.
Related reports: 15 · last report →Zero compensation for 3.3 million victims of Meta data leak
3.3mImpact: Personal data of 3.3 million people
A Meta personal data leak affected 3.3 million people, but compensation amounted to nothing. Calls were made to expand the scope of the class action system to provide redress for victims.
Read on 국민일보 ↗Travel agency fined KRW 750 million over leak of 3.06 million people's data
3.1mImpact: Personal data of 3.06 million people leaked
Personal data of 3.06 million people was leaked in connection with a travel agency. A fine of KRW 750 million was imposed over the incident. The agency's name, the date of the leak, the cause and specific response measures have not been confirmed.
Read on 서울신문 ↗Busan police investigate Air Busan impersonation site over suspected data theft
Suspicions arose that a website impersonating Air Busan was stealing personal data. Busan police launched an investigation into the site.
Read on 산경투데이 ↗
Key incidents in other countries
Massive X outages amid DDoS attack claims
Impact: Multiple service outages and user login problems
On 10 March 2025, X suffered multiple service outages and user login problems. Elon Musk blamed a massive cyber-attack, and Dark Storm claimed to have carried out a DDoS attack. Experts questioned Musk's claim that the attack was linked to Ukraine.
Related reports: 11 · last report →Jaguar Land Rover hack leaks source code and other data
Impact: 350GB of data
Jaguar Land Rover was hacked, and the attackers claimed to have leaked 700 files and source code. The Hellcat group carried out an attack using infostealers, followed by an attack from a second hacker. The volume of leaked data was later reported to be 350GB, and the company's response has not been confirmed.
Related reports: 5 · last report →Berkeley Research Group breach exposes data of about 6,000 people
6kImpact: Data and Social Security numbers of about 6,000 people
Data on about 6,000 people was leaked from Berkeley Research Group, exposing Social Security numbers. The breach came to light in March 2025, followed by guidance on legal rights related to the breach notifications.
Related reports: 4 · last report →New York State sues Allstate over string of data breaches at company and affiliate
A series of data breaches occurred at Allstate and affiliates including National General. New York State filed a lawsuit in March 2025, citing alleged security failings among other reasons. In October, the lawsuit was sent back to the state court.
Related reports: 4 · last report →New Zealand insurance broker investigates ransomware attack
A New Zealand insurance broker confirmed a breach of its IT systems and investigated a ransomware attack. The company notified privacy authorities and financial regulators and investigated the extent of the data affected. DragonForce claimed to have stolen more than 60GB of data, but the actual scale of the damage has not been confirmed.
Related reports: 3 · last report →