Week 47, 2025 security incident report

Coupang breach exposes about 33.7 million customer personal information records

33.7mImpact: About 33.7 million customer personal information records

About 33.7 million customer personal information records, including delivery addresses and order histories, were leaked from Coupang. Coupang launched an investigation after receiving a customer complaint on 16 November 2025, and the theft of authentication keys by a former employee was subsequently identified as the cause. Coupang recommended changing communal building entrance codes, and the personal data breach led to financial penalties and dispute mediation.

Netmarble PC game portal hack leaks personal data of 6.11 million people

6.1mImpact: Personal data of 6.11 million people plus 8,048 additional leaked records, including 1,304 resident registration numbers among the additional data

In November 2025, a hack of Netmarble's PC game portal revealed a leak of personal data belonging to customers, PC bang (internet café) owners, employees and others, with the number of victims confirmed at 6.11 million. A subsequent investigation found that an additional 8,048 records of personal data belonging to customer service enquirers, job applicants, business proposal contacts and others had been leaked, including 1,304 resident registration numbers. Netmarble advised users to change their passwords and apologised, and a fine was finalised over its reporting of the incident three days after becoming aware of it.

WINS Technet groupware hack likely leaked 1,000 employee records

1kImpact: Signs of about 1,000 employee records leaked

WINS Technet's groupware was hacked, with signs that about 1,000 employee records were leaked. The company only became aware of the hack around a year after it occurred. The Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission (PIPC) are investigating, and controversy has arisen over responsibility for the vulnerabilities and lax security management.

Ransomware attack hits overseas facility of LG battery subsidiary

An LG battery subsidiary said one of its overseas facilities had been targeted in a ransomware attack. The date of the attack, the scale of the damage and the specific response measures have not been confirmed.

Korean Air in-flight catering supplier's servers hacked

Korean Air's in-flight catering supplier was named as a hacking victim by the Clop ransomware group. As of 22 November 2025, whether data had been stolen was not disclosed. On 29 December, the hacking of a Korean Air partner's servers and the data leak were reported again.

KT internet installer leaks customer data; complaint closed

Impact: Customer personal information

A KT internet installation technician leaked customers' personal information. Even after receiving a report, KT closed the complaint by blaming voice phishing without verifying the facts.

Samsung Medison data allegedly stolen in third-party breach and put up for sale

A hacker is selling Samsung Medison data that they claim was stolen in a third-party breach. The authenticity of the data and the actual scale of the leak have not been confirmed.

LG Energy Solution and other South Korean industrial firms hit by hacks

Following Simmtech and SFA, LG Energy Solution was also hit by a hacker group. The specific scale of the damage, the date of the incident and the response have not been confirmed.

LG, Samsung Medison and HD Hyundai hit by hacks

LG, Samsung Medison and HD Hyundai were hit by hacks. The specific extent of the damage at each company, the dates of the incidents and the response have not been confirmed.

Korea Large Trawl Fisheries Cooperative financial branch allegedly hacked

Allegations of hacking have been raised at a financial branch of the Korea Large Trawl Fisheries Cooperative. Whether a breach actually took place, when it happened, the scale of the damage and the response have not been confirmed.

About 72 million Under Armour customer email addresses and other data exposed

Impact: About 72 million email addresses and some customers’ personal information; 541,773 email addresses belonging to users in South Korea, along with 36 names and 36 gender entries

Data containing about 72 million Under Armour customer email addresses, along with some names, genders, dates of birth and other information, was published online. The Everest ransomware group claimed to have stolen the data in November 2025, and Under Armour said in January 2026 that it was investigating. The company said there was no evidence that customer passwords or payment systems had been affected. In March 2026, it was confirmed that 541,773 email addresses belonging to users in South Korea, along with 36 names and 36 gender entries, had been exposed, and that the attacker had used a compromised valid employee account to gain unauthorised access to a secure FTP server.

Marquis ransomware attack leaks financial data of more than 670,000 people

672kImpact: Personal and financial information of more than 672,000 people stolen

Financial software company Marquis was hit by a ransomware attack, and bank customers' personal and financial information was stolen. Multiple banks and credit unions were affected and notified victims, and the scale of the damage disclosed in March 2026 is more than 672,000 people. Marquis brought a lawsuit claiming that a breach of SonicWall's cloud backup led to the attack.

Harvard alumni and fundraising breach exposes 850,537 accounts

Impact: Account information linked to 850,537 unique email addresses

Harvard University’s alumni and fundraising systems were compromised through telephone phishing in November 2025, leading to the theft of personal information. The stolen material included names, contact details, dates of birth, donation histories, family relationships and employment information, and hackers released it in February 2026. The breach data was added to Have I Been Pwned in November 2026, establishing that the affected accounts were linked to 850,537 unique email addresses.

Iberia customer data leaked in third-party supplier breach

Impact: Customer names, email addresses and loyalty membership numbers leaked; number of affected customers not disclosed

At Spanish airline Iberia, a breach at a third-party supplier led to the theft of customer names, email addresses and loyalty membership numbers. The company notified customers of the leak, activated its security response procedures and said passwords and banking information were not affected. The Everest ransomware group claimed to have stolen 596GB of data and later demanded $6 million in exchange for not leaking it.

Hack of US real estate data firm exposes major banks' customer data

Impact: Sensitive information of major US bank customers stolen

A real estate data firm that does business with major US banks was hacked, and sensitive customer information was stolen. JPMorgan, Citi and others were affected, and the banks began assessing the extent of the damage. The US Federal Bureau of Investigation (FBI) launched an investigation into the case.