Week 38, 2025 security incident report
Hacking and data breach incidents newly reported 2025.09.15 ~ 09.21
Between 15 and 21 September 2025, seven new incidents were recorded in South Korea, with a series of hacks and data leaks at 19 asset management firms standing out most. Harm to personal data continued, including the hacking of personal data of 160,000 farmers with the cause of the leak still unconfirmed and the leak of identifying information at T map Mobility, and an Apple account hack also caused financial losses of about 1 million won through 23 transactions in 30 minutes. In the tally of all types, personal data leaks were the most common at 28, followed by hacking/intrusion (15), ransomware (5) and malware (1). Overseas, the fallout from the ransomware attack on Collins Aerospace spread to Heathrow, Berlin Brandenburg and Brussels airports, causing check-in disruption and flight delays and cancellations, and a leak of data on 7.4 million customers of Kering's luxury brands was also confirmed.
By type
- Data breach26
- Hacking & intrusion14
- Ransomware5
- Malware1
Key incidents in South Korea
19 South Korean asset managers hit in serial hacks and data leaks
Impact: 19 South Korean asset management firms affected
The hacking group that had attacked Welcome Financial Group carried out a string of attacks on South Korean asset management firms and released their data. The number of affected companies, initially reported as 10, later rose to 13 and then 19. The Personal Information Protection Commission (PIPC) launched an investigation into personal data leaks resulting from the ransomware attacks on the asset managers.
Related reports: 5 · last report →Hacked Apple account drained of around 1 million won in 23 charges over 30 minutes
Impact: Around 1 million won
It was reported that a hacked Apple account was drained of around 1 million won in 23 transactions over 30 minutes. The date of the incident and the response have not been confirmed.
Related reports: 2 · last report →Personal data of 160,000 farmers hacked, cause of leak still unknown
160kImpact: Personal information of 160,000 farmers
The personal information of 160,000 farmers was leaked in a hack. Five months on, how the leak occurred had still not been established.
Read on KBS 뉴스 ↗TMAP Mobility identifier leak confirmed, hacking allegations investigated
Impact: Leak of identifying information
A leak of identifying information at TMAP Mobility was confirmed. An on-site investigation into the hacking allegations was carried out, and the date of the incident and the scale of the leak have not been confirmed.
Read on 이코노미사이언스 ↗Card company staff mocking customer raises personal data leak issue
Card company staff mocking a 38-year-old customer's use of a coin-operated karaoke room became a legal issue concerning personal information leaks. The name of the card company, the scale of the damage, the date of the incident and the response have not been confirmed.
Read on 로톡뉴스 ↗LG Uplus says no signs of breach after partner reports hack
A partner company of LG Uplus reported a hack. LG Uplus stated that there were no signs of a breach.
Read on 한국경제 ↗Samsung patches flaw exploited to hack customers' phones
A zero-day security vulnerability was exploited to hack Samsung Electronics customers' mobile phones. Samsung Electronics released a patch to fix the vulnerability. The scale of the damage and the countries where individual victims are located have not been confirmed.
Read on TechCrunch ↗
Supply-chain breaches
Domains used in Salesforce breach attacks taken down
A series of breach attacks targeting Salesforce took place. The FBI shared related indicators of compromise, and domains used by ShinyHunters to hack Salesforce were later taken down.
Related reports: 3 · last report →
Also affected: 1- StellantisStellantis third-party service provider breach leaks North American customer contactsNorth American customer contact information leaked
Collins Aerospace ransomware attack disrupts check-in at European airports
Impact: Check-in outages and delays at London Heathrow, Brussels and Berlin airports
Collins Aerospace's airport check-in system was hit by a cyber-attack, causing check-in outages and delays at London Heathrow, Brussels and Berlin airports in September 2025. The European Union Agency for Cybersecurity (ENISA) confirmed the cause was ransomware, and the company worked to restore its airline software. A suspect was later arrested in the UK, and Brussels Airport and the company moved to replace the check-in system.
Related reports: 6 · last report →
Also affected: 2- Heathrow AirportCyber-attack on Heathrow check-in systems delays flightsCheck-in system disruption and flight delays
- Berlin Brandenburg AirportCyber-attack fallout disrupts operations at Berlin Brandenburg AirportOngoing disruption to airport operations
Key incidents in other countries
Ransomware attack on aviation tech provider disrupts European airports
Impact: Check-in system outages at major European airports and flight delays and cancellations
A cyber-attack on a US-based aviation technology provider caused outages in check-in systems at major European airports in September 2025. Flight delays and cancellations followed, and the European Union confirmed ransomware was the cause. UK police arrested a man in connection with the attack.
Related reports: 36 · last report →Data of 7.4 million customers of Kering luxury brands leaked
7.4mImpact: Names, addresses and purchase histories of 7.4 million customers
Kering's Gucci, Balenciaga and Alexander McQueen were hacked, leaking customer information. The leak affected 7.4 million customers and included names, addresses and purchase histories. Kering confirmed the hack and said the data accessed was limited.
Related reports: 11 · last report →Collins Aerospace ransomware attack disrupts check-in at European airports
Impact: Check-in outages and delays at London Heathrow, Brussels and Berlin airports
Collins Aerospace's airport check-in system was hit by a cyber-attack, causing check-in outages and delays at London Heathrow, Brussels and Berlin airports in September 2025. The European Union Agency for Cybersecurity (ENISA) confirmed the cause was ransomware, and the company worked to restore its airline software. A suspect was later arrested in the UK, and Brussels Airport and the company moved to replace the check-in system.
Related reports: 6 · last report →SonicWall cloud backup breach exposes customer firewall configurations
A breach of SonicWall's MySonicWall accounts exposed customer firewall configuration backup files stored in the cloud. The company initially said fewer than 5% of customers were affected and asked them to replace related credentials and tokens. Claims later emerged that all firewall backups had been compromised, and in November SonicWall confirmed that state-sponsored hackers were behind the attack.
Related reports: 5 · last report →Indian actor Upendra and wife's phones hacked, contacts targeted in money scam
Impact: The couple's mobile phones, and money demands targeting their contacts
The mobile phones of Indian actor Upendra and his wife Priyanka were hacked, and a scam demanding money from people in their contacts followed. Upendra warned acquaintances and fans not to send money and to be wary of online scams.
Related reports: 5 · last report →