Week 26, 2025 security incident report
Hacking and data breach incidents newly reported 2025.06.23 ~ 06.29
Between 23 and 29 June, the case with the largest scale of damage in South Korea was the possible leak of about 37 million customer records over the past nine years through Papa John's Korea's ordering page. Exposures of personal data at consumer touchpoints continued, including the leak of customers' phone numbers and addresses at MUSTIT and the exposure of order information and some card details due to lax management of website source code, whilst a hack of TELUS's recruitment platform leaked the data of about 680,000 people worldwide, including 13,622 in South Korea. Of 60 new incidents in total, personal data leaks (32) and hacking/intrusion (25) accounted for the vast majority. Overseas, data leaks were reported affecting about 5 million people at Qantas, about 870,000 at Columbia University and about 2.2 million at Ahold Delhaize's US business, and knock-on damage from Ahold Delhaize to Hannaford Supermarkets also emerged.
By type
- Data breach28
- Hacking & intrusion25
- Phishing & smishing2
- Ransomware1
Key incidents in South Korea
Papa John's Korea order page exposes customer personal data
37mImpact: Possible leak of about 37 million customer records from the past nine years
It was found that changing a number in the URL of Papa John's Korea's order page exposed other customers' order histories and personal information without login or authentication. Concerns were raised that about 37 million customer records from the past nine years, including names, addresses and card numbers, may have been leaked. It emerged that the company had become aware of the problem in July 2024 but had not reported it to the Korea Internet & Security Agency (KISA), and the Personal Information Protection Commission (PIPC) launched an investigation.
Related reports: 9 · last report →Telus recruitment platform hack exposes data of about 680,000 people
680kImpact: Personal data of about 680,000 people worldwide, including 13,622 in South Korea
In 2023, Telus's recruitment platform for AI training data contributors was hacked, exposing the personal data of about 680,000 people worldwide, including 13,622 users in South Korea. Because administrator privilege checks were missing, ordinary user accounts could access all users' information. The Personal Information Protection Commission (PIPC) imposed a fine of 82 million won on Telus.
Related reports: 3 →Customer data breach at Papa John's and Mustit
Impact: Possible leak of up to nine data items, including member number, user ID, name, date of birth, mobile phone number and address
A customer personal data breach occurred at Papa John's and Mustit. Abnormal access was detected on 6–14 May and 9 June 2025, through an API that allowed some personal information to be queried without authentication. The companies announced that up to nine data items, including member number, user ID, name, date of birth, mobile phone number and address, may have been leaked.
Related reports: 3 →Mustit customers' phone numbers, addresses and other personal data leaked
Impact: Customers' personal data including phone numbers and addresses; scale of damage unconfirmed
A customer personal data breach occurred at luxury goods platform Mustit. The leaked information included phone numbers and addresses.
Related reports: 2 →Customer order data exposed due to poor website source code management
Impact: Customer order information including names, addresses and contact details; full card numbers and expiry dates of some customers
Poor management of a website's source code exposed customer order information stored since 2017. Along with names, addresses and contact details, the full card numbers and expiry dates of some customers were also exposed.
Read on 뉴스핌 ↗
Key incidents in other countries
Qantas leaks personal data of around 5 million customers
5mImpact: Personal data of around 5 million customers
Qantas was hit by a cyber-attack in 2025 that leaked customers' personal data. It was initially reported that a system holding the data of 6 million customers had been breached, and the personal data of around 5 million people was subsequently leaked on the dark web. The company responded to the publication of the leaked data and continued its investigation, and the attack was found to be linked to fake IT support calls.
Related reports: 56 · last report →Columbia University cyber-attack exposes personal data of about 3.1 million people
3.1mImpact: Personal information of about 3.1 million people
A cyber-attack on Columbia University in June 2025 disrupted IT services and exposed personal information. The number of people affected rose from an initial estimate of about 870,000 to about 3.1 million, and the exposed information included Social Security numbers, financial account details, academic records and medical information. The university agreed to pay US$16.1 million to settle related litigation, and an investigation in October 2026 found no evidence that the stolen information had been sold or distributed on the dark web.
Related reports: 32 · last report →Ahold Delhaize US business suffers data breach affecting 2.2 million people
2.2mImpact: Personal information of about 2.2 million people
Ahold Delhaize's US business said the personal information of about 2.2 million people had been leaked in a 2024 cyber-attack. The scale of the damage was disclosed in June 2025, and an investigation for related litigation was also reported.
Related reports: 9 · last report →Mexican drug cartel hacked FBI official to track informants
Impact: Identities of potential informants exposed and potential informants killed
Mexico's Sinaloa cartel used a hacker to hack the phone of an FBI official and conduct surveillance using cameras and phones. Through this, the cartel identified potential informants and witnesses, and a government audit revealed that it led to the killing of potential informants.
Related reports: 5 · last report →Glasgow City Council service disruption continues after cyber-attack
Impact: Ongoing disruption of council services
Glasgow City Council was hit by a cyber-attack, raising concerns about data theft. Service disruption was still continuing on 27 June 2025, a week after the attack. Whether data was actually stolen, the attack method and the specific response have not been confirmed.
Related reports: 3 · last report →