Week 48, 2025 security incident report
Hacking and data breach incidents newly reported 2025.11.24 ~ 11.30
Between 24 and 30 November 2025, the incident that attracted the most attention in South Korea was the Upbit hack, in which 44.5 billion won in crypto-assets was abnormally withdrawn. About 120,000 IP cameras in South Korea were hacked and private footage stolen, stolen data from KT Altimedia was made public, and a personal data leak occurred after an administrator account at a medical device company was hijacked. Among all incident types, personal data leaks were the most common at 33, and in South Korea, knock-on damage was notable as the Qilin ransomware group's breach of a South Korean MSP led to the theft of data from 28 companies. Overseas, the Mixpanel hack leaked data on OpenAI API users and an attack on CodeRED disrupted emergency alert operations, and knock-on damage via Cox, OnSolve and Oracle was also confirmed.
By type
- Data breach29
- Hacking & intrusion11
- Ransomware9
- Phishing & smishing1
- Malware1
Key incidents in South Korea
Upbit hack leads to abnormal withdrawal of 44.5 billion won in crypto
Impact: 44.5 billion won in virtual assets
In November 2025, a hack at Upbit led to the abnormal withdrawal of 44.5 billion won in virtual assets. Upbit suspended deposits and withdrawals and said it would fully cover the affected assets, while financial authorities launched an on-site inspection. Upbit later froze 2.6 billion won of the stolen assets using its in-house on-chain tracking system, and in June 2026 it was confirmed that the company had paid 790 million won in compensation related to the hack.
Related reports: 49 · last report →Around 120,000 IP cameras in South Korea hacked, private videos leaked
Impact: Around 120,000 IP cameras compromised and private videos stolen
Around 120,000 IP cameras in homes, businesses and other premises in South Korea were hacked and private videos were stolen. Devices set with simple passwords were mainly compromised, and some suspects used the stolen footage to produce 1,193 pieces of sexually exploitative material, which they sold on overseas sites. Four suspects were arrested, and the government pursued follow-up security measures.
Related reports: 19 · last report →Upbit hack causes 44.5 billion won in losses
Impact: 44.5 billion won
Upbit, operated by Dunamu, suffered a hack causing 44.5 billion won in losses. Dunamu moved to respond to the cyber intrusion incident. The Financial Supervisory Service completed its inspection of the incident and sent an inspection opinion to Dunamu, launching sanction proceedings.
Related reports: 7 · last report →Qilin ransomware gang breaches South Korean MSP, steals data from 28 companies
Impact: Data stolen from 28 South Korean companies
The Qilin ransomware gang breached a South Korean managed service provider (MSP) and stole its clients' data. The attack, dubbed 'Korean Leaks', affected 28 South Korean companies, including asset management firms.
Related reports: 5 · last report →Medical device companies leak personal data after admin account hijacking
Impact: Personal information leaked
Personal information was leaked at two medical device companies after administrator accounts were hijacked. The Personal Information Protection Commission (PIPC) imposed fines totalling 188.2 million won on the two companies.
Read on 데일리시큐 ↗
Supply-chain breaches
Oracle hack leads to data breach and extortion demands
A data breach occurred as a result of the Oracle hack. Oracle faced 11 related class actions in Texas. Extortion demands related to the hack continued afterwards.
Related reports: 2 · last report →
Also affected: 5- Schneider ElectricSchneider Electric and Emerson named as victims of Oracle hack
- Allianz UKClaimed Oracle EBS hack victims named as Allianz UK confirms breach
- GlobalLogicHR data of 10,471 current and former GlobalLogic employees stolenHR data of 10,471 current and former employees
- LogitechLogitech confirms customer data leak after Clop attackCustomer information
- CoxOracle EBS hack hits Cox and Canon subsidiaryDamage confirmed at Cox and a Canon subsidiary
Oracle EBS hack hits Cox and Canon subsidiary
↳ Knock-on damage from the Oracle incident · View original incidentImpact: Damage confirmed at Cox and a Canon subsidiary
In connection with the Oracle EBS hack, Cox confirmed it had been affected and Canon said one of its subsidiaries had been impacted. Cybercriminals named 100 organisations they claim are victims. The actual overall scale of the damage and the specific response have not been confirmed.
Read on SecurityWeek ↗
CodeRED ransomware attack disrupts US emergency alerts
Impact: Disruption of local emergency alert systems across the US and data breach
OnSolve's CodeRED emergency alert platform was hit by a ransomware attack, disrupting local emergency alert systems across the US and causing a data breach. Systems used in Pierce County and the Lehigh Valley were also affected. The CodeRED platform was shut down after the attack, and the exact scale of the breach has not been confirmed.
Related reports: 6 · last report →
Oracle Health hack leaks patient data of about 20 million people
20mImpact: Patient data of about 20 million people
Oracle Health was hacked in 2025, leaking patient data. The US Federal Bureau of Investigation investigated the attack, and leaks affecting healthcare providers were later disclosed. The scale confirmed in October 2026 is about 20 million people.
Related reports: 12 · last report →
Also affected: 3
Key incidents in other countries
Mixpanel hack leaks OpenAI API user data
Impact: Personal information such as names and email addresses of some API users
OpenAI's partner Mixpanel was hacked, leaking information such as the names and email addresses of some API users. OpenAI said ordinary ChatGPT users were not affected and urged caution over phishing emails and suspicious links. OpenAI ended its relationship with Mixpanel, and a class action was later brought against both companies.
Related reports: 26 · last report →Dartmouth College hack exposes data of more than 40,000 people
40kImpact: Personal data of more than 40,000 people
Dartmouth College had personal data stolen in an attack involving Oracle EBS, exposing US Social Security numbers and financial information. The college confirmed the data breach after Clop's extortion attack in November 2025. At least 35,000 people were initially reported to be affected, but the number later rose to more than 40,000.
Related reports: 9 · last report →Cyber-attack on CodeRED emergency alert system leaks data
Impact: Possible leak of information of thousands of Colorado residents
The CodeRED emergency alert system has been hit by a cyber-attack, raising concerns about data leaks in several parts of the US. In Colorado, the information of thousands of people may have been leaked, and counties in Northern California warned of the attack and data leak. Montague adopted a new emergency alert platform after the incident.
Related reports: 6 · last report →SitusAMC hack leaks client data
Impact: Client information and data of clients including major US banks
Real estate finance services firm SitusAMC suffered a leak of client information in a hack. Concerns were raised that data of its clients, including JPMorgan Chase, Citi and Morgan Stanley, may also have been exposed, and the banks checked the impact. SitusAMC's services were restored.
Related reports: 6 · last report →CodeRED ransomware attack disrupts US emergency alerts
Impact: Disruption of local emergency alert systems across the US and data breach
OnSolve's CodeRED emergency alert platform was hit by a ransomware attack, disrupting local emergency alert systems across the US and causing a data breach. Systems used in Pierce County and the Lehigh Valley were also affected. The CodeRED platform was shut down after the attack, and the exact scale of the breach has not been confirmed.
Related reports: 6 · last report →