Week 29, 2025 security incident report
Hacking and data breach incidents newly reported 2025.07.14 ~ 07.20
In South Korea, the most prominent incident was a ransomware attack on SGI Seoul Guarantee that shut down its computer services for about 81 hours and disrupted guarantee and loan operations. Personal data leaks occurred across multiple sectors, affecting 2,550 members of the game helper programme K Launcher, 1,000 election workers whose details were posted on a community service centre's website, and customers of Handok's health supplement shop, and in one case a game's official X account was hacked and exploited to promote crypto-assets. Across all types in South Korea and abroad, personal data leaks were the most common at 31, followed by hacking/intrusion (17) and ransomware (9). Overseas, the leak of about 72,000 user images along with private messages and addresses from the US dating app Tea and the UK Ministry of Defence's leak of data on thousands of Afghans were prominent, and knock-on damage from the UK government to the Secret Intelligence Service (MI6) was also noted.
By type
- Data breach30
- Hacking & intrusion17
- Ransomware9
- Phishing & smishing1
Key incidents in South Korea
Ransomware attack on SGI Seoul Guarantee disrupts guarantee and loan services
Impact: IT services down for about 81 hours and disruption to guarantee and loan services
In July 2025, SGI Seoul Guarantee was hit by a ransomware attack that paralysed its IT services and disrupted new jeonse loans and other services. The initial point of intrusion was identified as an SSL-VPN, and systems were restored from backups after 81 hours. The Gunra ransomware group claimed to have stolen 13.2TB of data, but this has not been confirmed; the company said there were no signs of a data leak and that it would fully compensate any financial losses.
Related reports: 24 · last report →StarCraft helper programme K Launcher leaks data of 2,550 members
2.6kImpact: Personal information of 2,550 members
Personal information of 2,550 members of K Launcher, a StarCraft helper programme, was leaked. The timing of the leak, its cause and the response have not been confirmed.
Read on 민주신문 ↗Personal data of 1,000 election staff leaked on local office website
1kImpact: Personal information of 1,000 election staff
Personal information of 1,000 election staff was posted on the news board of a local community office website and leaked. The specific name of the office, the timing of the posting and the response have not been confirmed.
Read on 매일경제 ↗Stellar Blade X account hacked to promote crypto
Impact: Stellar Blade X account misused to promote crypto assets
The X account of the game Stellar Blade was hacked and used to promote crypto assets. The game's director apologised to fans.
Read on VICE ↗Ransomware attack disrupts South Korea's largest guarantee insurer
Impact: Operational disruption
South Korea's largest guarantee insurer was hit by a ransomware attack that disrupted its operations. The specific scale of the damage and recovery measures have not been confirmed.
Read on The Korea Herald ↗Owner of dog hit by BB pellets alleges police leaked information
The owner of a dog that had to have an eye removed after being hit by BB pellets spoke out about the harm. The owner also alleged that the police had leaked information.
Read on 이데일리 ↗Handok health supplement online shop leaks customer data
Impact: Customer information
Customer information was leaked from Handok's health supplement online shop. The incident occurred a month after the subsidiary spin-off, and the scale of the damage and the response have not been confirmed.
Read on IT조선 ↗Analysis of ruling on personal data leak via handing over a smartphone
In a case where personal information was leaked by handing over a smartphone, whether the personal information was processed in the course of duties became the legal issue. A standard was set out that the act is not guilty if the requirement of processing in the course of duties is not met.
Read on 법치뉴스 ↗
Supply-chain breaches
UK data leak on Afghan allies leads to secret relocation of thousands
100Impact: Leak of information on Afghan allies and more than 100 British nationals; thousands of Afghans relocated
Information on Afghans who worked with British forces was leaked, leading to thousands being secretly relocated to the UK. The leaked data also included more than 100 British nationals, including intelligence officers and special forces members. The UK Government continued legal efforts to prevent the incident from being made public, and issues followed over compensation for some victims and the exclusion of others from compensation.
Related reports: 27 · last report →
Also affected: 1- Secret Intelligence Service (MI6)Afghan data leak exposes identities of MI6 officersIdentity information of MI6 officers
Key incidents in other countries
US dating app Tea hacked, exposing photos and private messages
Impact: About 72,000 user images, private messages and addresses leaked
Tea, a US dating information app for women, was hacked, and it emerged in July 2025 that about 72,000 user images had been leaked. The leaked material included personal images such as ID cards and selfies, and the exposure of private messages was also confirmed. A class action and the leak of users' addresses later became issues.
Related reports: 42 · last report →Ministry of Defence leaks data on thousands of Afghans
Impact: Leak of data on thousands of Afghans
The Ministry of Defence leaked the data of thousands of at-risk Afghans. Following the leak, more than 7,300 people became eligible for resettlement in the UK, and it was suggested that the leak may be linked to at least 49 deaths. Victims pursued legal action, and Parliament criticised the measures to prevent a recurrence as insufficient.
Related reports: 15 · last report →Singapore deploys military against cyber-attack on critical infrastructure
A cyber-attack targeting Singapore's critical infrastructure was confirmed to be ongoing in July 2025. UNC3886 was identified as the attacker, and alleged links to China were raised. Singapore deployed its military and Ministry of Defence units to respond.
Related reports: 7 · last report →Salt Typhoon breach of US National Guard exposes admin credentials
Impact: Administrator credentials and network diagrams exposed; access to networks in every US state
Chinese hacking group Salt Typhoon extensively breached a US National Guard unit in 2024. The breach lasted nine months and accessed networks in every US state. A Department of Homeland Security memo stated that administrator credentials and network diagrams were exposed.
Related reports: 5 · last report →UK sanctions Russian intelligence officers over cyber-attacks
Officers of Russia's military intelligence agency, the GRU, were identified as involved in cyber-attacks targeting the UK. In July 2025, the UK said it had discovered Russian espionage tools and sanctioned the intelligence officers involved. In the process, the identities of 18 Russian spies were made public.
Related reports: 4 →