Week 46, 2025 security incident report

Han Hye-jin's YouTube channel hacked to stream crypto broadcasts

860kImpact: Deletion of a YouTube channel with about 860,000 subscribers and unauthorised broadcasts

The YouTube channel of model Han Hye-jin, which has about 860,000 subscribers, was hacked, used to stream crypto-related broadcasts and then deleted. Han Hye-jin's representatives filed an appeal and took steps to restore it. The channel was later fully restored.

HR data of 5,000 Samsung Biologics employees leaked internally

5kImpact: Personal information of about 5,000 employees, including salaries, educational backgrounds and performance appraisals

Personal information of about 5,000 Samsung Biologics employees, including salaries, educational backgrounds and performance appraisals, was leaked on the company's internal network. Controversy also followed over a leak of psychological counselling information, and the company said there had been no external leak. Chief executive John Rim apologised and pledged to prepare countermeasures and work to prevent further damage, while the trade union filed a complaint against company executives.

Former Kakao executive Bae Jae-hyun claims brokerage account was hacked

Impact: Losses of 11 billion won claimed by Bae Jae-hyun

Bae Jae-hyun, Kakao's former chief investment officer, claimed he lost 11 billion won when his Mirae Asset Securities account was hacked. Mr Bae has brought a civil claim for damages against Mirae Asset Securities.

Ransomware attack paralyses K2 Korea's network

Impact: Network paralysis and disruption of shop operations

K2 Korea was hit by a ransomware attack that paralysed its computer network. The network outage disrupted shop operations. The specific date of the incident and response measures have not been confirmed.

Data of 5,000 employees leaked as questions raised over union laptop

5kImpact: Data of 5,000 employees

Data of 5,000 employees was leaked. Questions have been raised regarding a union laptop, but the specific connection between the affected organisation and the laptop and the response have not been confirmed.

Series of hacks at three major operators raises concerns over security ecosystem

A string of hacking incidents at South Korea's three major telecoms operators raised concerns about the safety of the security ecosystem. The dates, scale of damage and responses for the individual incidents have not been confirmed.

Police accessed personal data without authorisation and leaked sex crime victims' information

Impact: Leak of sex crime victims' information

The Board of Audit and Inspection (BAI) flagged unauthorised access to personal data by police and leaks of sex crime victims' information. The scale of the damage, the timing and follow-up measures have not been confirmed.

Telecoms operator's encryption breached amid malware cover-up controversy

A telecoms operator's encryption technology was breached, and controversy arose over an alleged cover-up of a malware infection. The operator's name, the scale of the damage, the timing and the response have not been confirmed.

K2 Korea Group network paralysed amid signs of ransomware attack

Impact: Network paralysis

K2 Korea Group's computer network was paralysed, and signs of a ransomware attack emerged. Concerns have been raised about a leak of customer data, but whether a leak actually occurred, the scale of the damage and the response have not been confirmed.

Police open preliminary inquiry into ransomware attack on Hanmaeum Blood Centre

Police opened a preliminary inquiry after Hanmaeum Blood Centre was hit by a ransomware attack. Whether any data was leaked is being checked, and the date of the incident and the scale of the damage have not been confirmed.

Chinese hacking group abuses Claude to attack organisations worldwide

Impact: About 30 targets, including tech companies and government agencies worldwide

Anthropic said a Chinese state-sponsored hacking group abused Claude to automate cyber-attacks against multiple organisations around the world. The targets included tech companies and government agencies, and Anthropic said it had blocked the attack activity. Questions were also raised about the level of automation in the attacks.

DoorDash personal data leaked after social engineering attack on employee

Impact: Contact details and personal information of customers, delivery workers and others leaked

At US delivery service DoorDash, a social engineering attack targeting an employee led to the theft of personal information of customers and delivery workers. The leaked information included contact details, and the company notified affected users of the breach. A lawsuit related to the data breach was subsequently filed.

Princeton University phishing incident exposes alumni and donor data

Impact: Names, email addresses, phone numbers and addresses of alumni, donors, students, academic and other staff and others exposed

On 10 November 2025, phishing targeting a member of staff at Princeton University led to a breach of its advancement and alumni database. Names, email addresses, phone numbers and addresses of alumni, donors, students, academic and other staff and others were exposed. The university disclosed the breach, and a class action alleging a failure to protect personal information was subsequently filed.

Mount Baker Imaging data breach from ransomware

Mount Baker Imaging suffered a data breach from a cyber-attack in 2025. A lawsuit was filed over the delayed breach notification, and the company sought a settlement of the ransomware-related litigation. In June 2026, it began the settlement process.

Edtech company hack exposes data of 3 million students

3mImpact: Data of 3 million students

An education technology company was hacked, exposing the data of 3 million students. The company agreed to a $5.1 million settlement with the attorneys general of three US states over the student data breach.