Week 3, 2026 security incident report

Kyowon Group hack causes data leak and business disruption

5.5mImpact: 5.54 million customers potentially affected; confirmed scale of personal data leak unknown

Kyowon Group was hacked in January 2026, resulting in data being leaked externally and business operations being disrupted. A ransomware attack was suspected, and the company said 5.54 million customers' personal data was potentially at risk of being leaked. The Personal Information Protection Commission (PIPC) launched an investigation, but as of 22 January the scope of the personal data leak had not been confirmed.

Lawsuit brought over hacking leak of emails and other personal data

Impact: Leak of personal information including email addresses

A lawsuit seeking damages for emotional distress was brought after personal information including email addresses was leaked through hacking. The Supreme Court ruled that even if personal information is leaked, there is no liability for statutory damages if no harm occurred, and that mere anxiety is not grounds for compensation.

Kyowon ransomware attack affects about 600 servers

5.5mImpact: About 600 virtual servers affected; 5.54 million customers at risk of information leak

Kyowon was hit by a ransomware attack on 10 January 2026, affecting about 600 virtual servers and disrupting operations at its affiliates. Kyowon reported the attack to investigative authorities and began recovery procedures, and on 12 January it confirmed signs that data had been leaked externally. Excluding duplicate subscriptions, 5.54 million customers are at risk of having their information leaked, and whether the actually leaked data includes customer information is under investigation.

Hack of POSCO E&C safety training system leaks subcontractor data

Impact: Personal information of subcontractor employees

POSCO E&C's safety training system for subcontractors was hacked, leaking the personal information of subcontractor employees. The leaked personal information was published on the dark web.

Newstapa YouTube channel deleted in hack restored after 30 hours

Impact: YouTube channel deleted; 30 hours to restore

Newstapa's YouTube channel was deleted after being hacked. The channel was restored 30 hours after it was deleted.

Personal data leaks to meet card sign-up targets raise outsourcing oversight concerns

Personal data leaks and cash handouts occurred in the course of meeting credit card sign-up targets. Concerns were raised over lax oversight by card companies that had outsourced the work.

Major South Korean company threatened by suspected ransomware attack

A major South Korean company was threatened by a suspected ransomware attack. The company's name, the scale of the damage and the specific response have not been confirmed.

Kumon and Red Pen data leak raises concerns over children's information

A data leak involving Kumon and Red Pen occurred. Concerns were raised about whether children's information had been leaked, and the specific scale of the damage and the response measures have not been confirmed.

Destructive cyber-attack targets about 30 Polish energy facilities

Impact: Attacks on communication and control systems at about 30 energy facilities; no disruption to power generation

In December 2025, a destructive cyber-attack targeted about 30 energy facilities in Poland. The attackers exploited default credentials and the absence of multi-factor authentication to attack communication and control systems, but no disruption to power generation occurred. Polish authorities said they had thwarted the attack and raised the possibility of links to Russia.

Betterment third-party marketing platform breach leaks customer data

Impact: Around 1.4 million unique email addresses and contact details such as names

A third-party marketing platform used by US investment service Betterment was breached, leaking customers' personal information, and scam messages promising to triple cryptocurrency transfers were sent out. In February 2026, around 1.4 million unique email addresses and personal information were found in the leaked data. The company said it had blocked the unauthorised access and that there was no sign of access to investment accounts and no exposure of passwords or login credentials.

University of Hawaii Cancer Center ransomware leaks data of about 1.2 million

1.2mImpact: Personal information of around 1.2 million people

The University of Hawaii Cancer Center was hit by a ransomware attack and subsequently confirmed a personal data leak. In February 2026 it announced a cyber-attack that had affected personal information, and in March the number of people affected was reported to be around 1.2 million.

PharMerica reaches class action settlement over data breach

A data breach at PharMerica led to a class action lawsuit. In January 2026, a federal judge preliminarily approved a settlement of about $5.2 million to $5.3 million. The timing of the incident, the scale of the breach and the attack method have not been confirmed.

Names and passport numbers of 308,777 Eurail customers leaked

308.8kImpact: Personal data of 308,777 people

A breach at Eurail in December 2025 led to the theft of customer names, passport numbers, contact details and more. DiscoverEU participants may also have had copies of identity documents, bank account reference information and health information exposed. Eurail disclosed that 308,777 people were affected, and some of the stolen data was published online or offered for sale.