Week 36, 2025 security incident report

Lotte Card hack leaks personal data of 2.97 million customers

3mImpact: Personal data of 2.97 million customers

Signs of hacking and malware infection on servers were found in Lotte Card's online payment system, and the leak of personal data of 2.97 million customers was later revealed. The leaked data included card numbers, CVC codes and resident registration numbers. Lotte Card carried out customer protection measures and compensation, followed by a fine, a business suspension penalty and a class action.

LG Uplus suspected of leaking server, account and employee data

167Impact: Suspected leak of data on 8,938 servers, 42,526 accounts and 167 employees; extent of damage not determined

In September 2025, allegations emerged that data on 8,938 LG Uplus servers, 42,526 accounts and 167 employees had been leaked, prompting a government investigation. LG Uplus maintained that its own investigation found no evidence of a breach, but reported signs of hacking to KISA in October. Controversy then continued over the disposal of suspected compromised servers, the reinstallation of operating systems and the submission of investigation materials, leading to a police investigation and claims of inadequate evidence preservation.

KT confirmed to have had malware-infected servers and failed to report incident

Impact: 43 servers confirmed infected with malware

Between March and July 2024, KT discovered 43 servers infected with malware including BPFDoor and handled them on its own without reporting. In a company-wide server inspection in September 2025, it found traces of intrusion and suspicious signs and reported them to the Korea Internet & Security Agency. A government investigation revealed the malware infections and the failure to report; KT apologised and announced plans to build an integrated monitoring system. Controversy continued afterwards over log deletion and the submission of materials.

Tampered Nexon Blue Archive CDN settings cause abnormal content exposure

Impact: Abnormal exposure of some content

An external attacker accessed the CDN configuration of Nexon's Blue Archive and altered the settings without authorisation, causing some content to be displayed abnormally. Nexon carried out emergency maintenance and blocked the attacker's access. It said user accounts, game data and payment information were not affected.

Jeju secondary school pupil obtains personal data of about 400 pupils without authorisation

400Impact: Personal information of about 400 pupils and coursework assessment marks of about 200

A pupil at a middle school in Jeju, South Korea, gained unauthorised access to a teacher's Google Workspace account whose initial password had never been changed. The pupil downloaded the personal information of about 400 pupils and the coursework assessment marks of about 200. The school reported the leak, deleted the data and changed passwords, and no external distribution has been confirmed.

Allegations of personal data leak to keep co-operative head post

Allegations have been raised that personal information was leaked in order to retain the position of co-operative head. The co-operative and individuals involved, the scale of the leak and whether the allegations are true have not been confirmed.

Jaguar Land Rover cyber-attack causes data leak and production halt

Impact: Data leak and prolonged production halt; company costs exceeding $220 million

Jaguar Land Rover suffered a cyber-attack in 2025 that led to a data leak and a prolonged production shutdown. The shutdown also affected parts supply and vehicle sales, and the company's direct costs reportedly exceeded $220 million. Resumption of UK production was reported in November 2025, and the possibility of Russian hackers and a state-sponsored attack was later raised.

Wealthsimple supply chain attack leaks customer personal data

Impact: Personal information and Social Insurance Numbers of some customers

A supply chain attack on Canadian investment platform Wealthsimple leaked customers' personal information, and some Social Insurance Numbers were also accessed without authorisation. A third-party software vulnerability was identified as the breach vector. Wealthsimple executives apologised to customers and said account information had not been misused.

Navy Federal Credit Union exposes 378GB of files through server misconfiguration

Impact: 378GB of files

378GB of Navy Federal Credit Union files were exposed through a misconfigured server. The exposed material included backup files, and when the incident took place and the response measures have not been confirmed.

Palo Alto Networks customer data and support cases leaked

Impact: Customer information and support case records

Palo Alto Networks confirmed unauthorised access to customer data via Salesforce. The leaked information included customer information and support case records. The scale of the damage and the specific date of occurrence have not been confirmed.

Chess.com file transfer app breach exposes 4,500 people's data

4.5kImpact: Information of 4,500 people

Chess.com suffered a data breach via a file transfer app in June 2025. Chess.com disclosed that the information of 4,500 people was stolen in the incident.