Week 23, 2025 security incident report

Data of 120,000 researchers leaked from NRF paper submission system

120kImpact: Personal information of around 120,000 researchers

JAMS, the online paper submission system of the National Research Foundation of Korea (NRF), was hacked, leaking the personal information of around 120,000 researchers. The foundation initially said no personal information had been leaked but later acknowledged the leak and reported it. The Personal Information Protection Commission (PIPC) investigated how the leak occurred and whether security obligations had been met, and later imposed fines and penalties totalling 707.8 million won.

Three including police officer charged over leaking Lee Sun-kyun probe details

Impact: Leak of investigation details in the case of actor Lee Sun-kyun

Three people, including a police officer and a prosecution investigator, were indicted on charges of leaking investigation details in the case of actor Lee Sun-kyun. The police officer and the prosecution investigator were indicted without being detained.

Personal data of over 10,000 Goyang public car park users leaked

10kImpact: Names, contact details and registration numbers of more than 10,000 public car park users

The personal data of more than 10,000 users of public car parks in Goyang was leaked. The leaked information included users' names, contact details and vehicle registration numbers.

Data from 7 million Netflix, Disney+ and other streaming accounts leaked

Impact: Personal data of 7 million streaming accounts

Personal data from 7 million accounts on streaming services such as Netflix and Disney+ was leaked. South Korea was among the affected countries, ranking seventh by scale of damage. Users were advised to change their passwords.

Hack of mobile coupon app Ilsang Cafe leaks up to 16 types of personal data

Impact: Up to 16 categories of customer personal data

The mobile coupon app Ilsang Cafe was hacked, leaking customers' personal data. Up to 16 types of personal data were reportedly leaked.

Chinese hackers breach US and South Korean telecoms networks amid backdoor fears

Telecoms networks in the US and South Korea were breached by Chinese hackers, and concerns were also raised about backdoor threats in the solar power sector. The specific affected organisations, scale, date of the incident and response were not specified.

Concerns raised over Chanel's response to data breach

Concerns were raised that Chanel has not issued a statement regarding its personal data breach. The leaked data items, the extent of the damage, the date of the incident and specific response measures have not been confirmed.

Hack of JAMS manuscript submission system raises fears of researcher data leak

Impact: Feared leak of data on tens of thousands of researchers

The JAMS manuscript submission system was hacked. There are concerns that data on tens of thousands of researchers was leaked, but whether data was actually leaked and the response have not been confirmed.

Unauthorised access to Cartier systems leaks customer data

Impact: Customer names, email addresses and countries of residence

An attacker gained unauthorised access to Cartier's systems and stole customers' names, email addresses and countries of residence. The company notified customers of the breach and said passwords and payment and banking information were not affected.

Customer accounts compromised on The North Face US website

Impact: Customer accounts compromised; possible access to names, delivery addresses and order histories

In April 2025, The North Face's US website was hit by a credential stuffing attack that compromised customer accounts. The attackers may have accessed names, delivery addresses and order histories, while customers' credit card information was confirmed to be safe. The company reset the passwords of the affected accounts.

India's KiranaPro has servers, app code and sensitive data wiped

Impact: Deletion of servers, app code and sensitive data

Indian grocery start-up KiranaPro had its servers, app code and sensitive data deleted in a cyber-attack. The chief executive confirmed the hack and the deletion of the servers. A co-founder later said the possibility of an external hack could not be ruled out.

Taiwan's BitoPro exchange hacked, about $11.5 million stolen

Impact: About $11.5 million in crypto assets

Taiwanese crypto exchange BitoPro confirmed that it was hacked in May 2025 and that assets worth about $11.5 million were stolen. The investigation found that the intrusion came through social engineering targeting a cloud operations staff member and the installation of malware, and the exchange named the North Korean hacking group Lazarus as the attacker.

Former American football coach accused of hacking female athletes' private photos

Impact: Alleged unauthorised access to private photos of thousands of female athletes

The US Department of Justice said a former American football coach had hacked private photos of thousands of female athletes. Some former university athletes were notified that the coach may have accessed their private photos without authorisation. The specific intrusion method and the date of the incident have not been confirmed.