Week 9, 2026 security incident report
Hacking and data breach incidents newly reported 2026.02.23 ~ 03.01
From 23 February to 1 March 2026, six new incidents were recorded in South Korea, most notably the theft of about 7 billion won in crypto assets after the National Tax Service exposed a mnemonic code, and a case involving the theft of bitcoin held by police. At AJ Networks, 4.8 TB of material believed to be internal data was published amid signs of ransomware, and secondary battery parts maker Sungwoo was also hit by ransomware, making attacks on companies stand out. Damage spanned public institutions, companies and universities, including a hack of Kyung Hee University's Info21 that leaked information on 89 people; across all types in South Korea and abroad, personal data leaks numbered 31, more than hacking/intrusions (11) and ransomware (10). Overseas, 46 new incidents were recorded, with large-scale personal data breaches standing out, including the leak of 38 million people's information following a breach at ManoMano's third-party customer service provider and the exposure of information from about 12.5 million CarGurus accounts.
By type
- Data breach29
- Ransomware11
- Hacking & intrusion10
Key incidents in South Korea
Two suspects arrested in Gangnam Police Station bitcoin theft case
Bitcoin was stolen from the Gangnam Police Station. It turned out that the company that had reported being hacked had stolen the bitcoin, and police arrested two suspects in the case. An inspection of 279 investigative agencies found coin theft only at the Gangnam Police Station, and police moved to set up a dedicated unit.
Related reports: 3 · last report →Signs of ransomware at AJ Networks, presumed data published
Impact: Publication of 4.8TB of material believed to be internal data
Signs of a ransomware hack have emerged at AJ Networks. It was reported that 4.8TB of material believed to be internal data was published on 4 March 2026.
Related reports: 2 · last report →Company that reported hacking stole bitcoin held by police
Impact: Theft of bitcoin held by police
Bitcoin held by police went missing, and a company that had reported being hacked turned out to be involved in the theft. One of the two people involved was arrested.
Related reports: 2 →Kyung Hee University Info21 hack leaks data of 89 people
89Impact: Information of 89 people leaked
A hack of Kyung Hee University's Info21 leaked the information of 89 people. The specific timing, the types of information leaked and the response measures have not been confirmed.
Read on 경희대학교 미디어센터 ↗National Tax Service exposes mnemonic code, about 7 billion won in crypto stolen
Impact: Cryptocurrency worth around 7 billion won
On 26 February 2026, Korea's National Tax Service exposed a mnemonic code for restoring an electronic wallet in a photo attached to a press release on seized virtual assets. A third party used it to steal cryptocurrency worth around 7 billion won. The National Tax Service apologised for the incident, and police opened an investigation.
Read on 한국경제 ↗Secondary battery parts maker Sungwoo hit by ransomware
Secondary battery parts maker Sungwoo was hit by a ransomware attack. The specific scale of the damage and the company's response have not been confirmed.
Read on 뉴스저널리즘 ↗
Supply-chain breaches
Lawsuit filed over medical technology firm's 2024 ransomware incident
A medical technology company suffered a ransomware attack and data breach in 2024. IU Health filed a lawsuit against the company.
Related reports: 2 · last report →
Key incidents in other countries
UFP Technologies ransomware attack affects 10,802 people’s personal information
10.8kImpact: Personal information of 10,802 people affected, along with the IT network and billing and shipping label generation functions
An attacker accessed systems at medical device and packaging manufacturer UFP Technologies between 11 and 14 February 2026, stealing and encrypting files. Most of its IT network and its billing and shipping label generation functions were affected, and the company warned of short-term shipment delays. The company completed its review of the affected information in late September and notified consumers on 6 November, confirming that 10,802 people’s personal information was affected.
Related reports: 20 · last report →Wynn Resorts employee data stolen, attackers demand payment
Impact: Employee data stolen
Wynn Resorts confirmed that an external attacker had stolen employee data and launched an investigation. The attacker demanded about $1.5 million in bitcoin, and the company said its business and facility operations were not affected. A class action lawsuit over the data breach was also filed.
Related reports: 5 · last report →Hacker exploits AI chatbot to steal Mexican government data
A hacker exploited Anthropic's Claude to steal Mexican government data. Claude Code and an AI chatbot were reportedly used in the attack. The specific agencies affected, the scale of the leak and the response measures have not been confirmed.
Related reports: 5 · last report →CarGurus breach exposes data of about 12.5 million accounts
12.5mImpact: Information of around 12.5 million accounts
A breach at CarGurus in February exposed the information of around 12.5 million accounts. ShinyHunters initially claimed to have stolen 1.7 million records, and CarGurus launched an investigation into the cyber-attack. Several lawsuits were subsequently brought, with claimants alleging inadequate data protection measures and a failure to give timely notice.
Related reports: 4 · last report →ManoMano third-party customer service supplier breach exposes 38 million customers
38mImpact: Account and customer support-related personal information of 38 million customers
French e-commerce company ManoMano confirmed in February 2026 that a breach at a third-party customer service supplier had affected 38 million customers. The attackers exfiltrated personal information relating to customer accounts and customer support.
Related reports: 3 · last report →