Week 39, 2025 security incident report
Hacking and data breach incidents newly reported 2025.09.22 ~ 09.28
Between 22 and 28 September 2025, 15 new cyber-security incidents were recorded in South Korea, with the leak of data on 3 million customers of a credit card company being the largest incident by the number of victims cited. A variety of data leaks followed in the financial, public and education sectors, including the personal data of 120,000 researchers at the National Research Foundation, sensitive health-related information at the Korea Disease Control and Prevention Agency and gift voucher PIN numbers at BiplPay. A ransomware attack on GJTech leaked internal documents of some 20 asset management firms, causing knock-on damage, and security concerns over hacks of telecoms and card companies, along with controversy over cover-ups, downplaying and whether the incidents could have been prevented, also came to the fore. Overseas, 46 incidents were recorded, with the leak of children's data at the Kido nursery chain and operational disruption at Heathrow, Berlin Brandenburg and Brussels airports following a ransomware attack on Collins Aerospace's check-in system standing out.
By type
- Data breach30
- Hacking & intrusion18
- Ransomware10
- Phishing & smishing1
Key incidents in South Korea
BePle Pay prepaid gift voucher PINs leaked
Impact: Prepaid top-up gift voucher PINs
PINs for prepaid top-up gift vouchers were leaked from BePle Pay in a hack. BePle Pay confirmed the leak of mobile gift voucher PINs.
Related reports: 3 · last report →Data of 3 million customers leaked at South Korean credit card company
3mImpact: Data of 3 million customers leaked
A data breach affecting 3 million customers occurred at a South Korean credit card company, prompting an investigation by the authorities. On 24 September 2025, MBK Partners Vice Chairman Yoon Jong-ha appeared as a witness in an inquiry into the hacking incident.
Related reports: 2 · last report →Research foundation hack exposes personal data of 120,000 researchers
120kImpact: Personal information of 120,000 researchers
The personal information of 120,000 researchers was leaked in a hack at a research foundation. Critics pointed out that the data was leaked through a rudimentary hack despite a security budget of 4.8 billion won, and that there were no improvement measures.
Related reports: 2 · last report →SK Telecom, KT and Lotte Card hacks fuel security fears
Following SK Telecom, hacking issues were raised at KT and Lotte Card in succession. The string of hacks fuelled growing anxiety over cybersecurity in South Korea.
Related reports: 2 · last report →GJTech ransomware attack leaks data of around 20 fund managers
Impact: Internal data of around 20 asset management firms
IT management company GJTech was attacked by the Qilin ransomware group. Internal data belonging to around 20 asset management firms using its file server service was found to have been leaked. Awesome Asset Management announced on 8 September 2025 that it had confirmed a ransomware infection on the file server.
Related reports: 2 →KDCA leaks sensitive personal data via misdirected texts and other errors
Impact: Sensitive health-related personal information
Personal information was leaked at the Korea Disease Control and Prevention Agency through text messages sent to the wrong recipients and other errors. The leaked information included sensitive health-related data.
Related reports: 2 →Trade ministry competition website hacked, unnoticed for over a month
A competition website run by the Ministry of Trade, Industry and Energy was hacked. The breach went unnoticed for more than a month.
Read on 경향신문 ↗Lotte Card and KT hacks spark row over whether they were preventable
Hacking incidents took place at Lotte Card and KT. Questions were raised over whether the two incidents were preventable, man-made failures.
Read on 경향신문 ↗Prime Minister Kim warns of consequences for any cover-up or downplaying of KT, Lotte Card hacks
Hacking incidents took place at KT and Lotte Card. Prime Minister Kim said those responsible would be held to account if there had been any cover-up or downplaying of the incidents.
Read on 조선일보 ↗UWAY Apply hack sparks fears over applicants' personal data
UWAY Apply was hacked. Concerns were raised about the safety of university applicants' personal information.
Read on 뉴스저널리즘 ↗
Supply-chain breaches
Ransomware attack on aviation tech provider disrupts European airports
Impact: Check-in system outages at major European airports and flight delays and cancellations
A cyber-attack on a US-based aviation technology provider caused outages in check-in systems at major European airports in September 2025. Flight delays and cancellations followed, and the European Union confirmed ransomware was the cause. UK police arrested a man in connection with the attack.
Related reports: 36 · last report →
Also affected: 1- Dublin AirportDublin Airport delays continue after cyber-attackOngoing airport delays
Collins Aerospace ransomware attack disrupts check-in at European airports
Impact: Check-in outages and delays at London Heathrow, Brussels and Berlin airports
Collins Aerospace's airport check-in system was hit by a cyber-attack, causing check-in outages and delays at London Heathrow, Brussels and Berlin airports in September 2025. The European Union Agency for Cybersecurity (ENISA) confirmed the cause was ransomware, and the company worked to restore its airline software. A suspect was later arrested in the UK, and Brussels Airport and the company moved to replace the check-in system.
Related reports: 6 · last report →
Also affected: 2- Heathrow AirportCyber-attack on Heathrow check-in systems delays flightsCheck-in system disruption and flight delays
- Berlin Brandenburg AirportCyber-attack fallout disrupts operations at Berlin Brandenburg AirportOngoing disruption to airport operations
Key incidents in other countries
Kido nursery hack leaks children's photos, names and addresses
8kImpact: Children's photos, names and addresses leaked; 8,000 children according to the attackers
Nursery chain Kido was hacked and children's photos, names and addresses were stolen. The attackers claimed to have obtained data on 8,000 children, threatened further releases and urged parents to pressure the nurseries into paying a ransom. The attackers later claimed to have deleted the data, and two teenagers were arrested in the UK in connection with the case.
Related reports: 11 · last report →Boyd Gaming cyber-attack leaks employee data
11kImpact: Employee data leaked; lawsuit claims at least 11,000 people could be affected
US casino operator Boyd Gaming was hit by a cyber-attack in which employee information was stolen. The company disclosed the data breach, and a lawsuit was later filed. The lawsuit claimed that at least 11,000 people could be affected.
Related reports: 7 · last report →Ransomware attack on RTX airline check-in system disrupts airport operations
Impact: Disruption to airport check-in and airline boarding software
RTX's airline check-in and boarding software was hit by a ransomware attack, disrupting airport check-in. The European Union's cybersecurity agency confirmed on 22 September 2025 that the outage was caused by ransomware, and RTX also confirmed the attack. A suspect was arrested in the UK in connection with the attack.
Related reports: 7 · last report →Harrods IT system breach leaks 430,000 customer records
430kImpact: 430,000 customer records
A breach of Harrods' IT systems led to the leak of 430,000 customer records. Harrods warned customers that their data may have been stolen, and the hackers later contacted the company.
Related reports: 5 · last report →Data of about 17,000 Volvo North America employees leaked via supplier
17kImpact: Personally identifiable and health information of about 17,000 employees
The personally identifiable information and health information of about 17,000 Volvo North America employees was leaked. Employee data was stolen in a ransomware attack targeting Miljödata, an IT and HR services supplier, and Volvo confirmed the exposure of personal information.
Related reports: 5 · last report →