Week 30, 2025 security incident report
Hacking and data breach incidents newly reported 2025.07.21 ~ 07.27
Between 21 and 27 July 2025, five new incidents were recorded in South Korea, the most prominent being a VPN intrusion at Haesung DS that leaked the personal data of 73,975 shareholders, staff and partner-company employees and infected an internal file server with ransomware. Other key issues included the deletion of a database following unauthorised intrusion at Jeonnam Technopark, personal data leaks and their recurrence at the Daesung Institute for Educational Development and Daesung Academy affiliates, and security measures for blocks of flats prompted by the hacking of wall pads that exposed 400,000 households nationwide. Across all types in South Korea and abroad, personal data leaks were the most common at 21, followed by hacking/intrusion (11), ransomware (5) and DDoS (1). Overseas, of 33 new incidents, the leak of data on 1.1 million customers of Allianz Life in the US and the breach of about 100 organisations through attacks on a SharePoint server vulnerability were prominent, with the US National Nuclear Security Administration (NNSA) named as a target of knock-on damage.
By type
- Data breach19
- Hacking & intrusion11
- Ransomware5
- DDoS1
Key incidents in South Korea
Haesung DS VPN intrusion leaks personal data of 73,975 people
74kImpact: Personal information of 73,975 shareholders, employees and partner company staff leaked, and internal file server infected with ransomware
In October 2023, an intrusion exploiting an SSL-VPN vulnerability at Haesung DS leaked the personal information of 73,975 shareholders, employees and partner company staff, and infected an internal file server with ransomware. The company was found to have neglected security updates and anti-malware measures, and in July 2025 it was fined 343 million won.
Related reports: 4 · last report →Unauthorised intrusion into Jeonnam Technopark system deletes database
Impact: Deletion of the Jeonnam Science and Technology Information System database
A hacker gained unauthorised access to Jeonnam Technopark's Jeonnam Science and Technology Information System, deleted its database and left a threatening message demanding money. The investigation found poor management of accounts, passwords and access controls, amongst other failings. The Personal Information Protection Commission (PIPC) imposed a penalty surcharge of 98 million won and an administrative fine of 3.6 million won.
Related reports: 2 →Daesung Institute for Academic Development leaks candidates' personal data
Impact: Personal information of exam candidates
Personal information of exam candidates was leaked from the Daesung Institute for Academic Development. The scale and timing of the leak, its cause and the response have not been confirmed.
Read on 전자신문 ↗Wall pad hack exposing 400,000 homes across South Korea prompts flat security measures
Impact: 400,000 households across South Korea exposed
An incident in which a wall pad hack exposed 400,000 households across South Korea was covered. IPScan HomeGuard was proposed as a security measure for existing blocks of flats.
Read on 데일리시큐 ↗Another personal data leak at Daesung Academy affiliate
Another personal data leak occurred at an affiliate of Daesung Academy. The name of the affected affiliate, the scale of the leak and response measures have not been confirmed.
Read on 뉴스저널리즘 ↗
Supply-chain breaches
About 100 organisations breached in attacks exploiting SharePoint Server vulnerabilities
Impact: About 100 organisations breached
About 100 organisations were affected by attacks targeting vulnerabilities in Microsoft SharePoint Server. Following the US government, the energy sector and universities, a breach at the US agency that manages nuclear weapons also came to light. Microsoft and the US Cybersecurity and Infrastructure Security Agency (CISA) warned of attacks targeting on-premises SharePoint servers, and some of the attacks were linked to China-linked groups.
Related reports: 7 · last report →
Key incidents in other countries
Allianz Life hack in the US leaks data of 1.1 million customers
1.1mImpact: Personal information of 1.1 million customers
Allianz Life in the US was hit by a cyber-attack that leaked customers' personal information. It was initially disclosed that most of its 1.4 million US customers were affected, and the scale of the damage was later specified as 1.1 million people. The attack was linked to a cloud-based customer relationship management system.
Related reports: 15 · last report →Central Maine Healthcare data breach affects about 145,000 people
145kImpact: Information on about 145,000 people
Information on about 145,000 people was leaked from Central Maine Healthcare. Six class actions over the breach had been filed by July 2025, and the scale of the damage became known in January 2026. In August 2026 the company agreed to a $1.3 million settlement, with payments of up to $5,000 to affected patients said to be possible.
Related reports: 7 · last report →About 100 organisations breached in attacks exploiting SharePoint Server vulnerabilities
Impact: About 100 organisations breached
About 100 organisations were affected by attacks targeting vulnerabilities in Microsoft SharePoint Server. Following the US government, the energy sector and universities, a breach at the US agency that manages nuclear weapons also came to light. Microsoft and the US Cybersecurity and Infrastructure Security Agency (CISA) warned of attacks targeting on-premises SharePoint servers, and some of the attacks were linked to China-linked groups.
Related reports: 7 · last report →Dell test platform breach leaks test data
Impact: Leak of fake data from the test and demonstration platform
Dell confirmed that its test and demonstration platform had been breached by the extortion group World Leaks. Dell said the data stolen and leaked by the attackers was fake data.
Related reports: 6 · last report →NASCAR ransomware attack exposes Social Security numbers and other data
Impact: Personal information including Social Security numbers
NASCAR was hit by a cyber-attack in March 2025 and had personal information stolen. NASCAR confirmed the data breach in July, and the leaked information included Social Security numbers. Lawyers subsequently launched an investigation into the incident.
Related reports: 5 · last report →