Week 17, 2025 security incident report

SK Telecom cyber-attack exposes personal and SIM data of 23.24 million people

23.2mImpact: Personal information and SIM data of 23.24 million people exposed

SK Telecom suffered a cyber-attack that exposed personal information, including SIM data, with 23.24 million people confirmed affected. Following the incident, SIM replacements and checks for personal data exposure began, and SK Telecom urged caution over spam and smishing exploiting the incident. The company was fined KRW 134.8 billion over the personal data breach and subsequently received an insurance payout.

Hack of two insurance agencies leaks data of 1,107 customers and staff

1.1kImpact: Personal information of a total of 1,107 customers and staff, plus insurance contract information of some customers

Hacks at two insurance agencies, Hana Financial Find and UFirst, leaked the personal information of a total of 1,107 customers and staff. A system developer's PC was infected with malware, administrator login credentials were stolen, and these were used to carry out the hack. The insurance contract types, insurers, policy numbers and premiums of some customers were also leaked, and the Financial Security Institute and the Personal Information Protection Commission (PIPC) launched investigations.

KS Korea Employment Information HR system hacked, employee data leaked

36kImpact: Personal data of about 36,000 current and former employees and 22GB of internal data

Testimony emerged that the HR management system of KS Korea Employment Information had been hacked, leaking personal data of about 36,000 current and former employees. Signs were confirmed that 22GB of data, including names, phone numbers, addresses, resident registration numbers and CVs with photos, was being sold on the dark web, and the Personal Information Protection Commission (PIPC) launched an investigation. A fine of KRW 3.5 billion was subsequently imposed over the personal data leak.

Korea Land and Housing Corporation leaks data of around 1,100 rental housing applicants

1.1kImpact: Personal information of around 1,100 rental housing applicants, including vulnerable group and disability status

Owing to an employee's mistake at the Korea Land and Housing Corporation, an original Excel file containing the personal information of around 1,100 applicants for national rental housing in Asan Tangjeong 2 was posted on LH Cheongyak Plus. Names, phone numbers, eligibility points and whether applicants belonged to vulnerable groups or had disabilities were exposed. Many people downloaded the file before a correction notice was issued.

Access permission error at Chungnam National University leaks graduates' data

Impact: Graduates' personal information

Chungnam National University mistakenly granted a student access permissions, leaking graduates' personal information. The scale of the leak and the date of the incident have not been confirmed.

Delivery rider's personal details posted over late order, leading to complaint

Impact: Delivery rider's personal information

A delivery rider's personal details were disclosed because a delivery was late. The disclosure led to a criminal complaint over the leak of personal information.

Designated-driver firm accused of unlawful dismissals and data leak

Allegations of unlawful dismissals and a personal data leak were raised against a designated-driver service company. Calls were also made for CJ, the client that contracted the work, to respond.

Mastern Investment Management IT systems infected with malware

Mastern Investment Management's IT systems were infected with malware. Concerns were raised about a leak of customer information, but whether data was actually leaked and how the company responded have not been confirmed.

Lazarus targets at least six South Korean organisations in IT, finance and other sectors

Impact: At least six South Korean organisations targeted

North Korea's Lazarus Group targeted at least six South Korean organisations in the software, IT, finance, semiconductor and telecommunications sectors in an attack dubbed Operation SyncHole. The attackers exploited watering-hole attacks and a vulnerability in Innorix Agent to move into internal networks and deployed the ThreatNeedle and LPEClient malware.

Marks & Spencer cyber-attack exposes customer data and disrupts trading

Impact: Customer data exposure and disruption to payments and online orders; estimated cost of £300 million

A cyber-attack in April 2025 disrupted contactless payments, online orders and click-and-collect services at Marks & Spencer, leading it to suspend online orders. In May, the company disclosed that customer data had been exposed and estimated the cost of the attack at £300 million. Its profit subsequently halved in the first half of 2025, while results published in November 2026 showed that profit had recovered following the cyber-attack.

Yale New Haven Health data breach affects about 5.6 million patients

5.6mImpact: Information of about 5.6 million patients

A data breach at Yale New Haven Health in March 2025 exposed the information of about 5.6 million patients. The organisation began notifying victims, and patients filed lawsuits. A class action settlement was later reached, establishing a compensation process that includes cash payments and medical data monitoring.

MTN Group cyber-attack leaks customer data

5.7kImpact: Information of 5,700 customers in Ghana

African telecoms company MTN Group disclosed in April 2025 that customer information had been leaked in a cyber-attack. MTN said its core infrastructure was secure, and 5,700 customers in Ghana were confirmed to have been affected. The attack was also accompanied by demands.

Blue Shield of California exposes data of 4.7 million members to Google

4.7mImpact: Personal information, including health information, of 4.7 million members

Personal information, including health information, of 4.7 million Blue Shield of California members was exposed to Google. The information was accidentally shared with Google's advertising service, and specific follow-up measures have not been confirmed.

Breach at former Ascension supplier exposes data of 437,329 patients

437.3kImpact: Personal information, Social Security numbers, and medical and insurance information of 437,329 patients

A data breach at a former supplier of Ascension exposed the information of 437,329 patients. The leaked data included personal information, Social Security numbers, and medical and insurance information, and exploitation of a software vulnerability at the supplier was identified as the cause. Ascension notified affected patients of the breach.