Week 49, 2025 security incident report
Hacking and data breach incidents newly reported 2025.12.01 ~ 12.07
Between 1 and 7 December 2025, seven new cyber-security incidents were confirmed in South Korea, with phishing impersonating compensation offers and prosecutors that exploited the Coupang data leak standing out most, leading to 11 million won in fraud losses and 229 phishing reports in 10 days. Problems with information protection across various industries and knock-on damage exploiting leaked data came to the fore, including unauthorised payments suspected of stemming from account takeovers at Gmarket, the leak of call data of 36 LG Uplus ixi-O customers, and alleged data theft and exposure as well as extortion in the securities, education and healthcare sectors. Across all types in South Korea and abroad, personal data leaks (22) and hacking/intrusion (17) accounted for most incidents. Overseas, 36 new incidents were confirmed, with large-scale harm to personal data prominent, including the leak of data on 5.8 million car dealership customers at 700Credit and 3.4 million people at the University of Phoenix.
By type
- Data breach22
- Hacking & intrusion17
- Phishing & smishing2
- Malware1
- Ransomware1
Key incidents in South Korea
Phishing impersonating compensation and prosecutors exploits Coupang data leak
229Impact: 11 million won defrauded and 229 phishing reports in 10 days
In December 2025, phishing scams impersonating damage compensation, refunds, card delivery and prosecutors emerged, using the Coupang personal data leak as a pretext. The attackers used text message links to lure victims into entering personal information and installing remote control apps, and one victim was reported to have been defrauded of 11 million won. The Korea Internet & Security Agency (KISA) warned of compensation-themed phishing, and the consumer alert level was also raised.
Related reports: 16 · last report →Unauthorised payments hit Gmarket amid suspected account takeover
Impact: Losses from unauthorised payments
Cases of unauthorised payments suspected to stem from account takeover occurred at Gmarket. Gmarket's CEO explained that the incidents were presumed to be account misuse unrelated to hacking. Gmarket announced full refunds of the unauthorised payment amounts and measures to strengthen security.
Related reports: 7 · last report →LG Uplus ixi-O leaks call data of 36 customers
36Impact: Call data of 36 ixi-O customers
Call data of 36 customers was leaked from LG Uplus's AI service ixi-O. LG Uplus said the incident was caused by an employee's operational error rather than hacking, and reported it to the Personal Information Protection Commission (PIPC). Controversy over the scale of compensation and on-device security followed.
Related reports: 6 · last report →Corporate executives' phone numbers apparently sold in bulk
Impact: Signs of sale of corporate executives' phone numbers
Signs emerged that phone numbers of corporate executives were being sold in bulk. The specific affected companies, how the information was obtained, the scale of the leak and the response have not been confirmed.
Read on 매일경제 ↗Meritz Securities investment records allegedly exposed on another person's phone
Impact: Alleged exposure of investment records
Allegations of a personal data leak were raised after Meritz Securities investment records were reportedly exposed on another person's mobile phone. The scale of the exposure, the cause and the response measures have not been confirmed.
Read on 포쓰저널 ↗Daegu final-year high school pupil breaks into staff room, steals teacher and student data
Impact: Teacher and student information
A third-year high school student in Daegu broke into a staff room and stole information on teachers and students. The school's name, the scale of the damage and the response after the incident have not been confirmed.
Read on 교육을 비추다 ↗Hacker threatens to leak cosmetic surgery photos amid weak clinic data security
A hacker threatened to release cosmetic surgery photos. Medical information at hospitals and clinics remains vulnerable in terms of security.
Read on 중앙일보 ↗
Key incidents in other countries
700Credit data breach hits 5.8 million car dealership customers
5.8mImpact: Personal information of 5.8 million car dealership customers
Personal information of car dealership customers was leaked at 700Credit, a US credit reference and data services company. The number of people affected was initially put at about 5.6 million and later at 5.8 million, with 18,000 car dealerships involved. Lawyers also launched investigations into the breach.
Related reports: 12 · last report →Petco misconfiguration exposes customer personal data online
Impact: Customer names, Social Security numbers and driving licence details
US pet supplies retailer Petco said a software configuration error had exposed files containing customers' personal information online. The exposed data included customer names, Social Security numbers and driving licence details.
Related reports: 7 · last report →University of Phoenix: 3.4 million people's data exposed in Oracle hack
3.4mImpact: Personal data of 3.4 million people
The University of Phoenix disclosed a personal data breach linked to the Oracle hack. The Clop gang's Oracle zero-day attack exposed the data of 3.4 million victims. A class action was subsequently filed alleging that the personal information of 3.5 million students had been exposed.
Related reports: 4 · last report →Massive student data breach at edtech company
Impact: Large-scale leak of student data; exact scale unknown
Student data was leaked on a large scale from an education technology company. The US Federal Trade Commission ordered the company to strengthen its data security, and state attorneys general also took action.
Related reports: 3 · last report →ASUS supplier hack leaks 1TB of data
Impact: 1TB of supplier data
An ASUS supplier was hacked by the Everest group, leaking 1TB of data. ASUS confirmed the breach of the third-party supplier, and the attackers released sample files.
Related reports: 3 · last report →