Week 16, 2026 security incident report

Allegations of unauthorised lookup and leak of Samsung Electronics employee data

Allegations were raised that a Samsung Electronics employee had accessed and leaked colleagues' personal information without authorisation. Samsung Electronics filed a criminal complaint against the employee, and it came to light that 20,000 records had been viewed in one hour. Later, in a personal data leak case related to union membership, six people, including the chair of the Super-Enterprise Union, were referred to prosecutors.

Kim Won-hee quits social media after hacking and early-morning money demand

Impact: Kim Won-hee hacked and stopped using social media

Kim Won-hee said she had been hacked and received an early-morning phone call from a foreigner demanding money. Shocked by the incident, Kim stopped using social media.

Prolonged IT outage at Hyundai Pharm delays drug orders and shipments

Impact: Drug ordering and shipping delayed by an IT outage lasting about two weeks

An IT outage at Hyundai Pharm that began in early April 2026 lasted about two weeks, delaying drug ordering and shipping for medical institutions. The possibility of a ransomware attack was raised, but the cause has not been confirmed. As of 15 April, it had not been confirmed whether operations had fully returned to normal.

DDoS attack temporarily disrupts access to South Korean foreign ministry website

Impact: Temporary access outage on the ministry's website

On the afternoon of 17 April 2026, the website of South Korea's Ministry of Foreign Affairs suffered a temporary access outage due to a DDoS attack. A Russian hacker later claimed to have attacked the ministry and other government agencies in response to South Korea's support for Ukraine.

Ransomware hits servers at six South Korean firms including hospitals and blocks of flats

Impact: Servers at six South Korean businesses encrypted and paralysed

From 2022 to July 2025, a ransomware gang encrypted the servers of six South Korean businesses, including hospitals and residential building management offices, paralysing their servers. The attackers broke in by brute-forcing default settings or simple account credentials. The gang's ringleader was arrested in Kazakhstan.

Mastermind of Hyundai Capital hack arrested and referred to prosecutors after 15 years

The mastermind of the Hyundai Capital hacking case was arrested 15 years later and referred to prosecutors in custody. The mastermind, who had been staying abroad, entered the country after a change of heart. The specific hacking methods and scale of damage have not been confirmed.

Sanctions proceedings under way over card company data leak

A data leak occurred at a card company, and related sanctions were announced. In mid-April, disciplinary action over the data leak and high cost burdens were cited as business headwinds for the card industry.

Hacker who stole data of 1.75 million people returns after 15 years on the run

1.8mImpact: Data of 1.75 million people stolen

A hacker who stole the data of 1.75 million people voluntarily entered the country after 15 years on the run. The affected organisation, the date of the incident and the response to the damage have not been confirmed.

Vercel internal systems breached, customer data and credentials leaked

Impact: Customer data and some customer credentials

The internal systems of cloud development platform Vercel were breached, leaking customer data and some customer credentials. An external AI tool used by an employee and the Context AI hack were identified as the intrusion route, and a link to malware disguised as Roblox cheats also came to light. Vercel urged customers to rotate API keys and other secrets.

ADT hack exposes data of 5.5 million customers

5.5mImpact: Data of 5.5 million customers

ADT had customer data stolen in a cyber intrusion, and the number of people affected was confirmed at 5.5 million. The exposed data included names, phone numbers, addresses and email addresses. ADT confirmed the breach after ShinyHunters threatened to release the data, and phishing was used in the attack.

Kelp DAO bridge hack steals $292 million in crypto assets

Impact: $292 million in crypto assets

$292 million in crypto assets was stolen from Kelp DAO in a bridge hack. After the incident, concerns spread about contagion risks across the DeFi ecosystem. LayerZero named North Korea's Lazarus Group as being behind the attack.

Hasbro employee account breach exposes personal and financial information

436Impact: Personal and financial information of 436 Massachusetts employees; total number affected not disclosed

Hasbro employee accounts were compromised, exposing personal and financial information of staff. A Massachusetts filing listed damage to 436 employees' Social Security numbers, financial accounts, card and driving licence details, and the total number of people affected has not been disclosed. A former employee filed a lawsuit over the data leak.

Data of about 1 million Basic-Fit members in Europe leaked

1mImpact: Personal data and bank account information of about 1 million members in six European countries

Basic-Fit, a Dutch fitness chain, had its member visit-tracking system breached, and the data of about 1 million members in six European countries was stolen. The leaked data included names, contact details, dates of birth and bank account information.