Week 15, 2026 security incident report

SK Innovation E&S reports hacking incident four years later

SK Innovation E&S reported a hacking incident to the Korea Internet & Security Agency (KISA) about four years after it occurred. The company explained that it had been unaware of its reporting obligation and said it could not confirm whether data had been leaked, even though a leak was presumed. Allegations later emerged that an employee died while responding to the hack and that the company had denied the hacking.

SK Innovation E&S belatedly reports server hack

Impact: Hack of about 15GB of server data

In April 2026 it emerged that SK Innovation E&S had belatedly reported a hacking incident that occurred about four years earlier. The hack hit 15GB of data on an SK E&S server directly managed by SK C&C, and allegations were raised that the incident was concealed for 40 months.

Kukje Pharma suffers internal data leak in Gunra hacking attack

Impact: Leak of internal data

Kukje Pharma suffered a leak of internal data in a hacking attack by the ransomware group Gunra (GUNRA). The incident raised concerns about security gaps and supply chain security in the pharmaceutical industry.

Joycity hit by ransomware, with signs of partial source code leak

Impact: Signs of partial source code leak

Joycity was targeted by the ransomware hacking group Odit Team, and signs emerged that part of its source code had been leaked. It later came to light that the company had suffered ransomware damage and had stored administrator account credentials in a Notepad file. Whether this method of storing credentials led to the breach has not been confirmed.

Baemin outsourced agent leaks customer data, prompting inspection

Impact: Customer data

An outsourced customer service agent for Baedal Minjok (Baemin) leaked customer data. The Personal Information Protection Commission (PIPC) responded by launching an inspection of customer service centres.

Police investigate signs of personal data theft by revenge-for-hire gang

Signs emerged that a gang offering revenge-for-hire services had stolen personal data not only from Baemin but also from other organisations. Police raided about 40 sites, including government agencies and financial institutions, suspected of leaking information to the gang.

Dongwon Home Food whistleblower's identity allegedly leaked to reported company

Impact: Alleged leak of whistleblower's identity

Allegations have been raised that the identity of a whistleblower involving Dongwon Home Food was passed on to the company that was reported. The Korea Internet & Security Agency (KISA) said the matter could constitute a breach of the Personal Information Protection Act.

DinDin changes phone number after production staff error leaks it

Impact: DinDin's phone number

DinDin had his personal information leaked owing to a mistake by production staff. DinDin changed his phone number after the leak.

Data leak row at 10,000-runner marathon

A personal data leak controversy has arisen at a marathon with 10,000 participants. The actual extent of the leak, when it occurred and the response have not been confirmed.

Suspected personal data leak at Shinhyup and use in chairman election

Allegations have been raised that personal data was leaked at Shinhyup, the Korean credit union, and used in a chairman election. Shinhyup has launched an urgent review of the circumstances.

Booking.com customer data leak followed by booking impersonation scams

Impact: Exposure of customer names and booking details, and possible leak of email addresses and phone numbers

A hacker accessed customer information at Booking.com, exposing travellers' names and booking details, and the possible leak of email addresses and phone numbers was also raised. The company secured its systems and changed booking PIN codes. Secondary damage followed, including WhatsApp and email payment scams exploiting booking details and smishing targeting people with bookings.

Rockstar Games hack leads to theft and release of analytics data

Impact: Limited non-material information and analytics data stolen and released

Rockstar Games was hacked, with data stolen and a ransom demanded. The company said a limited amount of non-material information had been accessed and that there was no impact on the company or its players. ShinyHunters later released the stolen analytics data.

Winona County Paid $128,000 After January Ransomware Attack

Impact: Network and some administrative services halted, $128,000 paid and residents' data leaked

Winona County in the US was hit by a ransomware attack in January 2026 that paralysed its network, and it paid $128,000 to resolve it. It was attacked again in April, which halted some administrative services and led to a data leak. The National Guard helped with the response, and in October the county began notifying residents whose information was stolen in the spring attack.

ChipSoft ransomware attack disrupts Dutch hospitals and exposes patient data

Impact: Disruption to hospital services in the Netherlands and theft of patients’ medical information

Dutch healthcare software company ChipSoft was hit by a ransomware attack that disrupted hospital services and resulted in the theft of patients’ medical information. ChipSoft confirmed that patient information had been stolen. In June, the company said all stolen data had been deleted and had not been made public.

Ransomware closes Spring Lake Park schools for two days

Impact: Schools closed for two days, 13-14 April

The Spring Lake Park School District closed its schools on 13 and 14 April 2026 due to a suspected ransomware incident. The district decided to reopen schools on 15 April.