Week 19, 2025 security incident report
Hacking and data breach incidents newly reported 2025.05.05 ~ 05.11
Between 5 and 11 May 2025, four new incidents were recorded in South Korea, with the theft of mobile gift vouchers worth 3 billion won through the hacking of an administrator account standing out most. A security breach at a small business led to the leak of a client company's new car project information, revealing knock-on damage, while the compromise of CJ OliveNetworks' electronic signature and a ruling on KCB's compensation to NH NongHyup Card over a personal data leak were also cited as key issues. Across all types, 20 hacking/intrusion incidents and 13 personal data breaches made up the majority. Overseas, the hacking of a messaging app used by US government officials leaked 410 GB of data, the hacking of LockBit's internal systems exposed negotiation records and operational data, and cyber-attacks on British retailers led to disruption in product supply.
By type
- Hacking & intrusion20
- Data breach12
- Ransomware4
- Malware2
- Phishing & smishing1
- DDoS1
Key incidents in South Korea
Admin account hack used to steal 3 billion won in mobile gift vouchers
Impact: Mobile gift vouchers worth 3 billion won
A gang hacked an administrator account and stole mobile gift vouchers worth 3 billion won. Police arrested 19 members of the gang, which operated as a cell-based organisation.
Related reports: 3 · last report →KCB ordered to compensate NH Nonghyup Card over personal data leak
A ruling found that KCB must pay 22.8 billion won in compensation to NH Nonghyup Card over a personal data leak. The dispute over the leak lasted 10 years, and the specific scale of the leak and the date of the incident have not been confirmed.
Read on 머니투데이 ↗Security breach at small firm leaks client's new car project
Impact: Information on a client's new car project
A security breach at a small business leaked information about a client's new car project. Concerns were raised about security weaknesses at small businesses and the risk of further hacking.
Read on 서울경제 ↗CJ Olive Networks digital signature compromised
Impact: Digital signature compromised
A digital signature belonging to CJ Olive Networks was compromised. The incident is believed to have resulted from a cyber-attack, and the specific scope of the damage and the response have not been confirmed.
Read on The Korea Times ↗
Key incidents in other countries
Messaging app used by US government officials hacked, data leaked
Impact: 410GB of data leaked
A messaging app used by US government officials, including Mike Waltz, was hacked and data was leaked. The app stored copies of messages, and the leaked data reportedly totalled 410GB. The operator temporarily suspended the service after the hacking claims, and more than 60 government officials had used the app.
Related reports: 10 · last report →LockBit internal systems hacked, negotiation logs and operational data leaked
Impact: 60,000 Bitcoin addresses, victim negotiation records and internal operational data
The ransomware gang LockBit was hacked, leaking its negotiation records with victims and internal operational data. Breaches of its dark web domain and admin panel came to light, and the leaked data included 60,000 Bitcoin addresses. The specific intrusion route and response have not been confirmed.
Related reports: 7 · last report →Alex Pereira claims account hacked over retirement-hinting post
Impact: Retirement-hinting post published on social media account
A post hinting at retirement appeared on Alex Pereira's social media account. Pereira said his account had been hacked and denied any intention to retire. Daniel Cormier later countered that Pereira's hacking claim was false.
Related reports: 6 · last report →Cyber-attacks on UK retailers disrupt product supply
Impact: Supermarket product supply disruption
Cyber-attacks targeted UK retailers, and a supermarket in Herefordshire experienced supply disruption, including empty shelves. The UK shared security guidance, and the National Crime Agency investigated several potential attackers, focusing on Scattered Spider.
Related reports: 5 · last report →GlobalX, operator of US deportation flights, hit by hack
GlobalX, which operated deportation flights for the Trump administration, was hacked. Anonymous was named as the attacker, and GlobalX confirmed the hack on 12 May.
Related reports: 5 · last report →