Week 2, 2026 security incident report
Hacking and data breach incidents newly reported 2026.01.05 ~ 01.11
Between 5 and 11 January 2026, the most prominent development in South Korea was evidence of hacking damage at a total of 25 organisations, companies and websites, including universities, hospitals and online shopping sites, showing a pattern of breaches spanning multiple industries. At Chungbuk National University's College of Veterinary Medicine, the leak of some website posts, such as the academic calendar, and signs of their sale on the dark web were confirmed, and turmoil in the telecoms market caused by the waiver of early termination fees after a hacking incident also continued. New incidents totalled three in South Korea and 34 overseas, with personal data leaks (15) and hacking/intrusion (14) making up the majority by type. Overseas, allegations of a data leak affecting about 17.5 million Instagram accounts and controversy over password reset emails, as well as the hijacking of Bruno Fernandes's X account, attracted attention, whilst UK schools faced closures and disruption to lessons owing to ransomware and cyber-attacks.
By type
- Data breach15
- Hacking & intrusion14
- Ransomware7
- Malware1
Key incidents in South Korea
Signs of hacking at 25 South Korean universities, hospitals and online shops
Impact: A total of 25 South Korean institutions, companies and websites targeted
The government and the Korea Internet & Security Agency (KISA) found signs that internal data from South Korean medical and educational institutions, online shopping sites and others had been stolen and was being sold on hacking forums. Signs of damage identified from December 2025 to 5 January 2026 were shared, and the leaked data included hall of residence outing records and plastic surgery clinic information. On 13 January, it was reported that further attacks by the hacker AshleyWood2022 had brought the total number of targets to 25.
Related reports: 6 · last report →Data from hack of Chungbuk National University vet school website apparently traded on dark web
Impact: Leak of some posts, such as the academic calendar, from the College of Veterinary Medicine website
The website of Chungbuk National University's College of Veterinary Medicine was hacked, and signs emerged that the leaked data was being traded on the dark web. The university said some posts, such as the academic calendar, had been leaked, but no sensitive information such as student names or mobile phone numbers was included.
Read on 뉴스1 ↗Cancellation fee waiver after hacking incident throws telecoms market into turmoil
Early cancellation fees were waived following a hacking incident. This caused turmoil in the telecoms market.
Read on 디일렉 ↗
Key incidents in other countries
Bruno Fernandes' X account hacked to post criticism
Impact: Bruno Fernandes' X account hijacked and unauthorised posts published
After Manchester United's FA Cup exit, captain Bruno Fernandes' X account was hacked. Posts criticising co-owner INEOS appeared on the account. The club announced the account had been hacked and asked fans not to interact with it.
Related reports: 10 · last report →Allegations of data leak affecting 17.5 million Instagram accounts
17.5mImpact: Alleged data leak affecting about 17.5 million accounts
In January 2026, allegations surfaced that data from about 17.5 million Instagram user accounts had been leaked and was circulating on the dark web. A security firm claimed personal data had been leaked, but Instagram denied the leak reports and said its service was secure.
Related reports: 7 · last report →Instagram password reset email controversy and leak allegations
Concerns grew as users received password reset emails amid allegations that data from 17.5 million Instagram accounts had been leaked. Instagram denied any data breach and fixed a password reset vulnerability.
Related reports: 7 · last report →Warwickshire secondary school closes after ransomware attack
Impact: IT system failures, school closure and lesson cancellations
A secondary school in Warwickshire, UK, closed after a cyber-attack caused failures in its IT systems. Lessons were cancelled and the reopening schedule was delayed, after which plans to reopen the school were announced. The attack was identified as ransomware, but the school's name and specific recovery measures have not been confirmed.
Related reports: 4 · last report →UK's Higham Lane School closed for about two weeks after cyber-attack
Impact: In-person lessons suspended for about two weeks and failures of communications, management and safety systems
Higham Lane School in the UK suspended attendance for pupils and staff due to a cyber-attack. The closure was extended because phones, email, the school management system, electronic doors and fire alarms were not working. The school resumed in-person lessons, which had been suspended for about two weeks.
Related reports: 4 · last report →