Week 40, 2025 security incident report
Hacking and data breach incidents newly reported 2025.09.29 ~ 10.05
In South Korea, the leak of customers' personal data, including card and bank account details, at Mirae N Seohae Energy and the leak of data on 50,093 members of the National Fire Agency's 119 Gosi site emerged as major incidents. Exposures of personal and sensitive data continued across sectors such as mains gas, the public sector, education and healthcare, and among all incident types, personal data leaks were also the most common at 18. A compensation mobile phone scam exploiting the USIM hacking crisis claimed some 60 victims, and phishing impersonating card issuance in the wake of the Lotte Card hack also occurred, highlighting additional damage that exploited earlier incidents. Overseas, production and logistics disruption following a ransomware attack on Asahi Group, the possible compromise of about 1.9 million personal records and knock-on damage to Seven-Eleven Japan were prominent, and large-scale data leaks involving Discord's outsourced customer support provider and Salesforce customers also continued.
By type
- Data breach17
- Ransomware8
- Hacking & intrusion7
- Phishing & smishing2
Key incidents in South Korea
Mirae N Seohae Energy leaks customer card, bank account and other personal data
Impact: Customer personal information including card and bank account details
Customer personal information was leaked at Mirae N Seohae Energy, which supplies gas to north-western South Chungcheong Province. The leaked information included customers' card and bank account details.
Related reports: 5 · last report →Data of 50,093 members leaked from firefighter recruitment site 119Gosi
50.1kImpact: IDs, names, dates of birth, mobile phone numbers, email addresses and other details of 50,093 members
The IDs, names, dates of birth, mobile phone numbers, email addresses and other details of 50,093 members were leaked from 119Gosi, a recruitment website for firefighters. The National Fire Agency became aware of the incident on 2 October 2025 and shut down the site. Police and relevant authorities investigated the possibility of hacking and the route of the leak.
Related reports: 4 →South Chungcheong city gas supplier leaks customer data in ransomware attack
Impact: Personal information including customers' bank account and card numbers
A city gas supplier in South Korea's South Chungcheong Province was hacked, leaking customers' personal information. The information leaked in the ransomware attack included customers' bank account numbers and card numbers.
Related reports: 4 · last report →Professor discloses grade-appealing student's score in email to entire class
Impact: Exam score of a student who appealed their grade disclosed
A professor disclosed the exam score of a student who had appealed their grade in an email to all students. The National Human Rights Commission of Korea ruled this a human rights violation.
Related reports: 3 →About 60 people defrauded in 'compensation phone' scam exploiting USIM hack
60Impact: About 60 people defrauded
About 60 people fell victim to a scam that exploited the USIM hacking incident by offering so-called compensation phones. The specific dates of the losses and any response measures have not been confirmed.
Read on 문화일보 ↗Julie's side vows tough action over redistribution of illegally leaked CCTV footage
Impact: Illegal leak and redistribution of CCTV footage
Controversy arose over the redistribution of illegally leaked CCTV footage. Representatives of KISS OF LIFE member Julie said they would take strong action with no leniency.
Read on SBS 뉴스 ↗ResMed Korea notifies customers of sensitive data leak
Impact: Leak of customers' sensitive information
A leak of sensitive information occurred at ResMed Korea. The company notified customers of the leak during the holiday period. The scale, cause and timing of the incident have not been confirmed.
Read on 뉴스톱 ↗Phishing scam impersonates card issuance in wake of Lotte Card hack
A phishing scheme impersonating card issuance has emerged, exploiting the Lotte Card hacking incident. The actual extent of the damage and its timing have not been confirmed.
Read on 머니투데이 ↗
Supply-chain breaches
Asahi ransomware attack disrupts Japanese production amid data leak concerns
2.3mImpact: Potential exposure of 2.28 million personal information records and disruption to production and dispatches in Japan
Asahi Group suffered a cyber-attack in September 2025 that disrupted production and dispatches in Japan, and subsequently confirmed that it was a ransomware attack. The ransomware group Qilin claimed responsibility, while the company kept operations running through manual processes. By July 2026, the number of personal information records potentially exposed had increased to 2.28 million.
Related reports: 48 · last report →
Also affected: 1- Seven-Eleven JapanAsahi cyber-attack leaves Seven-Eleven Japan short of beerShortage of Super Dry beer
Key incidents in other countries
Asahi ransomware attack disrupts Japanese production amid data leak concerns
2.3mImpact: Potential exposure of 2.28 million personal information records and disruption to production and dispatches in Japan
Asahi Group suffered a cyber-attack in September 2025 that disrupted production and dispatches in Japan, and subsequently confirmed that it was a ransomware attack. The ransomware group Qilin claimed responsibility, while the company kept operations running through manual processes. By July 2026, the number of personal information records potentially exposed had increased to 2.28 million.
Related reports: 48 · last report →Hack of Discord's outsourced support vendor leaks ID images and more
70kImpact: ID images of about 70,000 people and personal information of customer support users
Discord's outsourced customer support vendor was hacked, leaking customer support request records and users' personal information. The leaked data included ID images submitted by about 70,000 people for age verification. Discord confirmed that information had been stolen through a third-party breach and confirmed the scale of the ID exposure.
Related reports: 38 · last report →Millions of records leaked after data theft from Salesforce customers
Impact: Data stolen from dozens of customers and millions of records released
Attackers stole data from dozens of Salesforce customers and used it to demand money. The attackers claimed to have obtained more than about 1 billion records, and Salesforce refused to pay. Even after the FBI's takedown, the attack group released millions of records.
Related reports: 11 · last report →Extortion escalates after Red Hat GitLab data breach
Red Hat confirmed a data breach related to a GitLab compromise. After the attack by Crimson Collective, ShinyHunters joined in the extortion demands, escalating the threats. The attackers claimed to have obtained large amounts of data, but the specific extent of the damage has not been confirmed.
Related reports: 6 · last report →Medusa ransomware gang publishes 834GB of Comcast data
Impact: 834GB of data published
The Medusa ransomware gang claimed to have attacked Comcast and stolen 834GB of sensitive data. The attackers demanded $1.2 million and then published the data. Whether Comcast confirmed the attack or how it responded has not been confirmed.
Related reports: 3 · last report →