Week 25, 2025 security incident report
Hacking and data breach incidents newly reported 2025.06.16 ~ 06.22
Between 16 and 22 June, a hack in South Korea in which the North Korean flag was broadcast during a church's YouTube livestream of a worship service emerged as a major incident, with related cases, including that of Onnuri Church, each reported. A hacking incident at a corporate insurance agency exposed a blind spot in security supervision of the insurance industry. Incident types overall were concentrated in personal data leaks (40) and hacking/intrusion (22), and knock-on damage spreading from United Natural Foods to Darlings Grocery, Whole Foods Market, Inc. and UBS Group AG also emerged. Overseas, a $177 million settlement over the AT&T customer data leak received the most coverage, whilst the exposure of some 16 billion login credentials and large-scale leaks of personal and health data at Aflac and Episource were also prominent.
By type
- Data breach39
- Hacking & intrusion22
- Ransomware4
- Malware2
- Phishing & smishing1
- DDoS1
Key incidents in South Korea
Hacked YouTube livestream of Korean church service airs North Korean flag
Impact: North Korean flag broadcast during a YouTube livestream of a church service
A YouTube livestream of a church service in South Korea was hacked, and the North Korean flag was broadcast during the stream. The name of the church, the specific extent of the damage and the response have not been confirmed.
Related reports: 2 · last report →North Korean flag airs during Onnuri Church service livestream
Impact: North Korean flag broadcast during a service livestream
A hacking incident caused the North Korean flag to be broadcast during a livestream of a service at Onnuri Church. The church launched an urgent investigation into the incident.
Related reports: 2 · last report →Hack at corporate insurance agency exposes gap in security oversight
A hacking incident at a corporate insurance agency exposed a regulatory blind spot in security oversight. Corporate insurance agencies had been outside the scope of security supervision because they are not classified as financial companies.
Read on 뉴스1 ↗
Supply-chain breaches
United Natural Foods cyber-attack disrupts grocery supply
Impact: Disruption to operations and grocery supply, and forecast lost sales of up to $400 million
Whole Foods supplier United Natural Foods suffered a cyber-attack in June 2025 that disrupted its operations and grocery supply. The company took some systems offline, then worked on recovery and resumed order intake and shipments. In July, it forecast that lost sales from the attack could reach up to $400 million.
Related reports: 16 · last report →
United Natural Foods hack disrupts grocery supply
Impact: Product shortages at some Whole Foods shops and forecast lost sales of hundreds of millions of dollars
United Natural Foods, a major distributor for Whole Foods, was hit by a cyber-attack that halted its systems and deliveries. Some Whole Foods shops experienced product shortages, and the company said in mid-June 2025 that recovery was under way. In July, it disclosed forecast lost sales from the attack and a revised annual earnings outlook.
Related reports: 8 · last report →
Also affected: 2Chain IQ cyber-attack leaks data linked to UBS and others
Impact: Data related to UBS, Pictet, KPMG and others
Chain IQ was hit by a cyber-attack that resulted in a data leak. The leak affected several companies, including UBS, Pictet and KPMG.
Read on CPO Magazine ↗
Also affected: 1- UBSBreach at procurement firm Chain IQ leaks UBS employees' business contact detailsData of 130,000 UBS employees
Key incidents in other countries
16 billion login credentials for Google, Apple and others exposed online
16bnImpact: About 16 billion login credentials
It was discovered that 16 billion login credentials for multiple services, including Google, Apple, Facebook and Telegram, had been exposed online. After it was confirmed that the data included previously leaked records, doubts were raised about interpreting it as a single new large-scale breach.
Related reports: 35 · last report →Aflac cyber intrusion exposes personal data of about 22.7 million people
22.7mImpact: Personal, health and insurance-related information of about 22.7 million people
US insurer Aflac detected a cyber intrusion on 12 June 2025, and personal data as well as health and insurance-related information of customers, beneficiaries, employees and agents was stolen. The total number affected was later confirmed at about 22.7 million, of whom at least 13.9 million had protected health information compromised. The company said it had not been affected by ransomware and proceeded with notifying victims.
Related reports: 26 · last report →Episource ransomware attack leaks health data of over 5.4 million
5.4mImpact: Health information of more than 5.4 million patients
Healthcare services and technology company Episource was hit by a ransomware attack that leaked the health information of more than 5.4 million patients. The company notified millions of people that their health information had been stolen. US senators later criticised UnitedHealth's cybersecurity in connection with the incident and demanded an explanation.
Related reports: 12 · last report →Nobitex hack burns about $90 million in Iranian crypto
Impact: About $90 million in crypto assets stolen and effectively burned; service suspension
In June 2025, the infrastructure and hot wallets of Nobitex, Iran's largest crypto exchange, were breached, about $90 million in crypto assets was stolen and services were suspended. The pro-Israel hacking group Predatory Sparrow, which claimed the attack, sent the assets to addresses from which they are hard to recover, effectively burning them. An analysis of the leaked source code was later published.
Related reports: 11 · last report →Cyber-attack on Iran's Bank Sepah disrupts banking and petrol station services
Impact: Nationwide banking service outages and petrol station service disruptions
Iran's Bank Sepah was hit by a cyber-attack that caused nationwide service outages and also disrupted petrol station services. A pro-Israel hacking group claimed responsibility for the attack and said it had destroyed the bank's data.
Related reports: 9 · last report →