Week 18, 2026 security incident report
Hacking and data breach incidents newly reported 2026.04.27 ~ 05.03
From 27 April to 3 May 2026, seven new incidents were identified in South Korea, with the leak of personal data on people in world football, including Son Heung-min and Lee Kang-in, and the leak of personal and passport information on adoptees and prospective parents from a government adoption information system emerging as the major incidents. Golf-related cases piled up, including a large-scale personal data leak at Lee & Lee Golf Club and allegations that South Korean golf-related personal data had been leaked to a North Korean hacking group, while concerns over vehicle data leaks and controversy over the unauthorised provision of virtual accounts were also raised. Across all types in South Korea and abroad, personal data leaks were the most common at 36, followed by hacking/intrusions at 21, and chain damage also occurred, spreading from GrayRobinson to Churchill Claims Services, from Citizens Bank to Frost Bank and from Drift Protocol to Carrot. Overseas, among 56 new incidents, a hack of the Canvas learning platform led to leaks of student and staff information and disruptions to classes and exams, and leaks of information on about 5.99 million people at Carnival and 3.8 million at Medtronic also stood out.
By type
- Data breach34
- Hacking & intrusion20
- Ransomware3
- Phishing & smishing2
- Malware1
Key incidents in South Korea
Personal data of global football figures including Son Heung-min and Lee Kang-in leaked
Impact: Personal data of global football figures including Son Heung-min and Lee Kang-in
Personal data of people in world football, including Son Heung-min and Lee Kang-in, was leaked on a large scale. Concerns were raised about misuse of the leaked data, with the FIFA president and Ronaldo also mentioned as being at risk.
Related reports: 2 · last report →Korean government adoption information system leaks data of adoptees and prospective parents
Impact: Personal and passport information of adoptees and prospective parents
Adoptees' personal information, including other people's passports, was exposed in the Korean government's adoption information system. It later emerged that prospective parents' information had also been leaked.
Related reports: 2 · last report →Controversy over Yeosu's Cho Kye-won's handling of leaked roster
Cho Kye-won of Yeosu described the leaked roster as old data and said the impact of the leak was minimal. This sparked controversy over the handling of personal data, while the timing and scale of the leak have not been confirmed.
Read on 뉴스탑전남 ↗Concerns raised over vehicle data leaks without drivers' knowledge
Concerns were raised about vehicle data leaks that eight drivers were unaware of. The specific organisations involved, the scale of the leak, the timing and the response have not been confirmed.
Read on 브런치 ↗South Korean golf-related personal data allegedly leaked to North Korean hacking group
Concerns were raised about lax protection of golf-related personal data in South Korea. The possibility was raised that personal data had been leaked to a major North Korean hacking group.
Read on 레저신문 ↗Controversy over Woongjin Preedlife's unauthorised provision of virtual accounts
Concerns were raised about Woongjin Preedlife's unauthorised provision of virtual accounts. Along with claims that it was subject to criminal penalties, remarks by the chief financial officer regarding a business suspension came to light.
Read on 외교저널 ↗
Supply-chain breaches
GrayRobinson network breach affects personal data of 65,113 people
65.1kImpact: Personal, financial account, medical and health insurance information of 65,113 people
US law firm GrayRobinson said a network breach in March 2025 had affected the personal information of 65,113 people. The information included names, Social Security numbers, ID numbers and financial account, medical and health insurance information. Four class actions were filed alleging that victim notification was delayed by 13 months.
Related reports: 4 · last report →
Also affected: 1- Churchill Claims ServicesChurchill Claims Services: personal data of 2,610 people leakedPersonal data of 2,610 people
Citizens Bank customer data leaked in third-party breach
Impact: Customers' personal data including Social Security numbers and contact details
Citizens Bank customers' personal data was exposed in a third-party data breach. The leaked data included Social Security numbers and contact details. Two federal lawsuits were filed against the bank after the incident.
Related reports: 7 · last report →
Drift Protocol hack steals $280 million in crypto assets
Impact: $280 million in crypto assets
Hackers stole $280 million in crypto assets from Drift Protocol, a Solana-based DeFi platform. Signs pointed to a North Korea-linked hacking group, and Upbit and Bithumb suspended deposits and withdrawals after detecting abnormal transactions. Drift published a relief plan and sought $150 million in support from Tether, and signs later emerged of the attacker laundering funds through Tornado Cash.
Related reports: 6 · last report →
Also affected: 1- CarrotCarrot shuts down in wake of Drift hackShutdown of operations
Key incidents in other countries
Canvas learning platform hack causes data leak and exam disruption
Impact: Leak of student and staff data and disruption of classes and exams at many US schools
A hack of Canvas, the learning platform run by Instructure, led to a data leak and service outages at many US schools. During May final exams, students were unable to complete their tests, and Boise State University cancelled some finals. Instructure said the hackers returned the data after extortion over the stolen information.
Related reports: 184 · last report →Carnival staff account takeover exposes data of around 5.99 million people
6mImpact: Personal data of around 5.99 million people
A social engineering attack targeting employee accounts at cruise operator Carnival led to the leak of personal data of around 5.99 million travellers. Carnival disclosed the data breach in May 2026. A class action was filed over delays in notifying customers, and Texas authorities opened an investigation into the incident, which affected more than 800,000 residents.
Related reports: 45 · last report →Medtronic corporate IT breach exposes data of 3.8 million
3.8mImpact: Personal data of 3.8 million people
Medtronic confirmed in April 2026 unauthorised intrusion into and data access on its corporate IT systems. ShinyHunters claimed to have stolen more than 9 million personal data records and internal materials, whilst the company said operations were not affected. The number of people affected was later confirmed at 3.8 million, and the company notified victims of the breach in July.
Related reports: 16 · last report →Unauthorised access to Trellix source code repository leads to data leak
Impact: Breach of part of the source code repository
Trellix confirmed unauthorised access to and a breach of part of its source code repository and launched an investigation. RansomHouse claimed responsibility for the attack, released screenshots of access to management systems and also claimed to have encrypted data. The authenticity of the released material has not been verified, and Trellix said it was investigating the claims.
Related reports: 5 · last report →GrayRobinson network breach affects personal data of 65,113 people
65.1kImpact: Personal, financial account, medical and health insurance information of 65,113 people
US law firm GrayRobinson said a network breach in March 2025 had affected the personal information of 65,113 people. The information included names, Social Security numbers, ID numbers and financial account, medical and health insurance information. Four class actions were filed alleging that victim notification was delayed by 13 months.
Related reports: 4 · last report →