Week 52, 2025 security incident report
Hacking and data breach incidents newly reported 2025.12.22 ~ 12.28
In South Korea, the leak of 192,088 personal records of merchant representatives by a Shinhan Card employee stood out most in both scale and coverage, with 2,600 of those records containing credit information. Leaks of staff data followed one after another in the aviation and retail industries, including a hack of a Korean Air partner company, a hack of Asiana Airlines' internal network and data leaks at Shinsegae Group and Shinsegae I&C. New incidents in South Korea and abroad totalled 34, with personal data leaks the most common at 19, and knock-on damage from Nissan to Nissan Motor Co., Ltd. was also confirmed. Overseas, service outages and financial and system damage occurred, including the shutdown of Ubisoft's game servers, the theft of about $7 million in crypto-assets from Trust Wallet, disruption to La Poste's postal and financial services, and a ransomware attack on Romania's water authority.
By type
- Data breach18
- Hacking & intrusion8
- Ransomware4
- DDoS1
Key incidents in South Korea
Shinhan Card insider leaks 192,088 merchant owner records
192.1kImpact: 192,088 records of merchant representatives' personal information, of which 2,600 include credit information
In December 2025, it emerged that a Shinhan Card employee had leaked 192,088 records of personal information of merchant representatives to the outside for use in recruiting new card customers. The leaked data included mobile phone numbers and some names and dates of birth, and 2,600 of the records were later found to include credit information as well. Shinhan Card apologised and said it would compensate victims, and financial authorities and the police opened an inspection and an investigation.
Related reports: 45 · last report →Partner hack leaks about 30,000 records of Korean Air employees
30kImpact: About 30,000 records of employees' personal information, including names and bank account numbers
Servers at KC&D Service, Korean Air's in-flight catering and in-flight sales partner, were hacked, leaking about 30,000 records of Korean Air employees' personal information, including names and bank account numbers. The partner became aware of a possible incident in November 2025 after spotting a post on the dark web in which a hacking group claimed the leak. Korean Air disclosed the leak of employees' personal information in December.
Related reports: 14 · last report →Asiana Airlines intranet hack leaks data of about 10,000 employees
10kImpact: Personal information of about 10,000 people, including employees
On 24 December 2025, Asiana Airlines' internal intranet was hacked through abnormal access routed via overseas servers, leaking the personal information of about 10,000 people, including employees. The leaked information included names, contact details and email addresses, but no customer information. The company began blocking the access path and resetting passwords.
Related reports: 12 · last report →Employee ID numbers of around 80,000 Shinsegae Group staff and others leaked
80kImpact: Employee ID numbers of around 80,000 employees and partner-company staff, including names, departments and IP addresses of around 3,000
The employee ID numbers of around 80,000 employees and some partner-company staff were leaked from the Shinsegae Group intranet. For around 3,000 of them, names, departments and IP addresses were also leaked, and malware introduced from outside was thought to be the cause. Shinsegae said at the time that no customer information had been leaked, and the investigation was later widened over suspicions of North Korean involvement.
Related reports: 6 · last report →Shinsegae I&C intranet hack leaks personal data of over 80,000 employees
80kImpact: Personal information, including employee ID numbers, of more than 80,000 employees
Shinsegae I&C's intranet has been hacked, leaking personal information, including employee ID numbers, of more than 80,000 employees. The date of the incident and the response measures have not been confirmed.
Read on M이코노미뉴스 ↗Korea Construction Safety Association leaks personal data including passwords
Impact: Personal information including passwords
Personal information including passwords has been leaked from the Korea Construction Safety Association. The scale of the leak, when it took place and the response measures have not been confirmed.
Read on 뉴스저널리즘 ↗Account takeover at KT alpha's Giftishow leads to unauthorised gift card purchases
Impact: Unauthorised gift card purchases, amount unknown
On 14 December 2025, an incident took place at KT alpha's Giftishow in which other people's accounts were logged into and used to make unauthorised gift card purchases. KT alpha suspected account takeover using IDs and passwords illegally collected elsewhere. The fraudulent payments were fully refunded.
Read on 연합뉴스 ↗Prison sentence upheld for exchange operator who leaked secrets on North Korean hacker's orders
Impact: Leak of classified information
A cryptocurrency exchange operator, acting on instructions from a North Korean hacker, recruited a military officer and leaked classified information. The Supreme Court upheld the operator's prison sentence.
Read on 조선일보 ↗
Key incidents in other countries
Ubisoft takes Rainbow Six Siege servers offline after hack
Impact: Arbitrary distribution of in-game currency and rare items, account bans and unbans, and server shutdown on all platforms
In December 2025, a breach occurred in Rainbow Six Siege in which in-game currency and rare items were handed out arbitrarily and accounts were banned and unbanned. Ubisoft took the game servers offline on all platforms, and the servers came back online on 29 December. Ubisoft then compensated players and announced changes including the introduction of Secure Boot.
Related reports: 17 · last report →Trust Wallet Chrome extension hack steals $7 million
Impact: About $7 million in crypto assets
The Chrome extension of Binance-affiliated Trust Wallet was hacked, and about $7 million in users' crypto assets was stolen. Trust Wallet confirmed the losses and urged users to update. Changpeng Zhao said the losses would be reimbursed.
Related reports: 13 · last report →Cyber-attack on France's La Poste disrupts postal and financial services
Impact: Outages and disruption to French postal and online banking services
In December 2025, during the Christmas peak season, French postal operator La Poste was hit by a cyber-attack that disrupted its postal and online banking services. French authorities opened an investigation, and pro-Russian hackers claimed responsibility for the attack.
Related reports: 11 · last report →Nissan: 21,000 customers' data exposed in hack of partner Red Hat
21kImpact: Data on 21,000 customers leaked
Data on 21,000 Nissan Motor customers was leaked through a hack of servers belonging to its partner Red Hat. Nissan Motor confirmed the customer data breach in December 2025.
Related reports: 9 · last report →Ransomware attack damages systems at Romanian Waters
Impact: About 1,000 systems affected and 10 branch offices nationwide paralysed
Romanian Waters has been hit by a ransomware attack using BitLocker, affecting about 1,000 systems and 10 branch offices nationwide. The agency confirmed the cyber-attack, and core water management operations were not affected.
Related reports: 7 · last report →