Week 35, 2025 security incident report

Signs of government On-Nara system access and certificate log leak

2.8kImpact: Signs of a leak of around 2,800 GPKI certificate verification logs

Signs emerged that the On-Nara system had been accessed using government employees' accounts and that around 2,800 GPKI certificate verification logs belonging to government and bank staff had been leaked. Allegations were also raised that hacking targeting the Korean government began in January 2025 at the latest and was linked to the Chinese hacking group SLIME68. The government's fact-checking was under way, and whether the intrusion succeeded and the full extent of the damage had not been determined.

134.8 billion won fine finalised over personal data leak

A fine of 134.8 billion won was finalised as a penalty for a personal data leak. The sanctioned organisation and the scale of the leak have not been confirmed.

Ransomware attack disrupts Nevada state government services

Impact: Theft of state data and disruption of government services including offices, websites and telephones; $1.5 million in response costs

After discovering a cyber-attack on 24 August 2025, the Nevada state government temporarily closed its offices and suspended some websites and telephone services. Emergency services remained in operation, and although the state initially said there was no evidence of a personal data breach, it later confirmed a ransomware attack and the theft of state data. The attack was traced to a state employee installing a system administration tool containing malware, and the state spent $1.5 million on its response without paying a ransom.

TransUnion hack exposes data of 4.4 million US consumers

4.4mImpact: Personal information of around 4.4 million US consumers

TransUnion said a hack had exposed the personal information of around 4.4 million US consumers. The Social Security numbers of around 17,000 Rhode Island residents were also exposed. The company confirmed that the breach notification letters sent to consumers were genuine, and a class action was brought over the data breach.

Ransomware disrupts Pennsylvania Office of Attorney General operations

Impact: Outages of internal systems, website, email and phones; delays in case processing; leak of personal information including social security numbers

The Pennsylvania Office of Attorney General in the United States was hit by a ransomware attack in August 2025 that encrypted files and disrupted access to email, documents and internal systems. Court case processing and operations were delayed, and the office did not pay a ransom, handling some work by alternative means. It later confirmed the leak of personal information, including social security numbers, and notified residents.

Maryland Transit Administration ransomware attack disrupts transport services

Impact: Disruption to paratransport services and real-time bus location information, and data exposure

The Maryland Transit Administration in the US was hit by a cyber-attack that disrupted paratransport services for people with disabilities and real-time travel information in August 2025. The agency arranged temporary transport, and paratransport services were restored about a month later. The Rhysida ransomware group claimed responsibility for the attack and demanded $3.4 million, and state officials said they did not pay the ransom.

University of Iowa Community HomeCare breach affects about 211,000 people

211kImpact: Information on about 211,000 people

Community HomeCare, part of the University of Iowa health system, suffered an intrusion in July in which patient and client files were viewed and copied. About 211,000 people were affected, and depending on the individual, the data may have included names, Social Security numbers, and insurance and medical information. Community HomeCare disclosed the breach.