Week 20, 2025 security incident report
Hacking and data breach incidents newly reported 2025.05.12 ~ 05.18
Between 12 and 18 May 2025, seven new cyber-security incidents were recorded in South Korea, with the breach of Dior's customer management service, which exposed customers' names, contact details, addresses and purchase information, attracting the most attention with 29 articles. Harm to personal data was prominent in retail, fashion and finance, including Temu's unauthorised transfer and processing of South Korean users' personal information, a leak of Adidas customer data and a savings bank personal data leak affecting 220,000 people. Across all incident types in South Korea and abroad, personal data leaks totalled 29, far outstripping 9 hacking/intrusion cases and 6 ransomware attacks, and knock-on damage was also identified, spreading from Co-op to Nisa Retail Limited and from MBE CPAs to MedicareCompareUSA. Overseas, of 38 new incidents, the Coinbase case, in which bribed customer support staff led to the leak of personal data of 69,461 customers, received the most coverage, whilst Nucor halted part of its production and Broadcom data was leaked following a ransomware attack on a payroll service provider.
By type
- Data breach28
- Hacking & intrusion9
- Ransomware6
- Phishing & smishing1
Key incidents in South Korea
Dior customer data leaked via breach of customer management service
Impact: Personal data including customer names, phone numbers, addresses and purchase information
Customer personal data was leaked at Dior in January 2025, but the company only became aware of the incident in May. Employee credentials used to access an external customer management service were misused, exposing customer names, phone numbers, addresses, purchase information and more. Dior notified and apologised to affected customers, saying financial account and card details were not included in the breach.
Related reports: 29 · last report →Kim Jae-joong reveals he was a victim of KakaoPay hacking
Kim Jae-joong disclosed that he had been a victim of KakaoPay hacking. He also complained that the support he received was inadequate.
Related reports: 6 · last report →Temu leaked and processed South Korean users' personal data without consent
Impact: Personal information of South Korean users
It came to light that Temu had leaked South Korean users' personal information without authorisation and processed facial data and resident registration numbers without authorisation. Temu was fined 1.3 billion won for privacy violations.
Related reports: 4 · last report →Adidas hack exposes customer names, contact details and more
Impact: Customers' personal information, including names, addresses, email addresses and phone numbers
Personal information of Adidas customers, including names, addresses, email addresses and phone numbers, was leaked. Adidas said it had been hit by a hacking attack and that customer email addresses, phone numbers and other details may have been leaked.
Related reports: 3 · last report →Leak of 220,000 people's data puts savings banks' internal controls under scrutiny
220kImpact: Personal information of 220,000 people
The personal information of 220,000 people was leaked. The incident heightened tension over savings banks' internal controls.
Read on 헤럴드경제 미주판 ↗SK Group moves to strengthen security across all affiliates amid hacking controversy
Amid criticism over hacking, SK Group decided to strengthen security across all its affiliates. As a response measure, it moved to establish a special information protection committee.
Read on 지디넷코리아 ↗Information of disclosure-request filers leaked, followed by pressure and protests
Impact: Information of people who filed information disclosure requests
The information of people who had filed freedom-of-information requests was leaked. In connection with the leaked information, the filers were subjected to persuasion attempts and protests.
Read on KBS 뉴스 ↗
Supply-chain breaches
Oracle Health hack leaks patient data of about 20 million people
20mImpact: Patient data of about 20 million people
Oracle Health was hacked in 2025, leaking patient data. The US Federal Bureau of Investigation investigated the attack, and leaks affecting healthcare providers were later disclosed. The scale confirmed in October 2026 is about 20 million people.
Related reports: 12 · last report →
Also affected: 3UK Co-op hack exposes data of 6.5 million members
6.5mImpact: Data of 6.5 million members stolen; about $275 million in lost revenue
The UK's Co-op detected attempts at unauthorised access to its network in late April 2025 and shut down some IT systems. The attackers broke in by using social engineering to reset staff passwords, and it was later confirmed that data on all 6.5 million members had been stolen. Back-office, call centre and product supply operations were disrupted, and the company reported a revenue loss of about $275 million.
Related reports: 30 · last report →
Also affected: 1Lawsuit investigation into MBE CPAs data breach
A lawsuit investigation was conducted in connection with a data breach at MBE CPAs. The date of the breach, the extent of the damage, the cause and response measures have not been confirmed.
Read on ClassAction.org ↗
Key incidents in other countries
Bribed Coinbase support staff leak data of about 70,000 customers
69.5kImpact: Personal information of 69,461 customers
Attackers bribed Coinbase support staff to steal customers' personal information, including copies of passports, and the number of victims was confirmed at 69,461. The attackers demanded $20 million, but Coinbase refused and instead offered a reward of the same amount for information on the attackers. Coinbase expected the cost of the incident to reach up to $400 million, and in December 2025 a former support agent linked to the case was arrested in India.
Related reports: 43 · last report →Valve denies system breach amid claims of 89 million leaked Steam accounts
Impact: Phone numbers leaked; extent of damage unconfirmed
Claims emerged that data from 89 million Steam accounts had been leaked. Operator Valve denied that its systems had been breached or that account information had been leaked, and said passwords were safe. The leaked data was described as phone numbers, and the claimed number of accounts has not been confirmed as the actual extent of the damage.
Related reports: 9 · last report →Nucor cyber-attack halts some production, data stolen
Impact: Temporary production halt at several sites and limited data leak
In May 2025, US steelmaker Nucor took some networks offline and temporarily halted production at several sites in response to a cyber-attack. The company disclosed the incident and recovery work in a filing with the US Securities and Exchange Commission. In June, it restored operations and confirmed a limited data leak.
Related reports: 7 · last report →Andy Frain Services ransomware attack affects 100,000 people
100kImpact: 100,000 people affected
Security company Andy Frain Services said a ransomware attack affected 100,000 people. A potential lawsuit over the data breach was also being investigated. When the attack occurred, what specific data was leaked and what recovery steps were taken have not been confirmed.
Related reports: 2 →Ransomware attack on payroll provider leaks Broadcom data
Payroll service provider Business Systems House was hit by a ransomware attack, and Broadcom's data was stolen. The leak was reported on 16 May 2025, and the extent of the damage and response measures have not been confirmed.
Related reports: 2 · last report →