Week 20, 2026 security incident report

Jang Dong-ju claims billions of won in losses from phone hacking and blackmail

Impact: Claimed losses of billions of won

Actor Jang Dong-ju said he suffered losses of billions of won due to mobile phone hacking and blackmail. He sold his home to pay off debts and announced his retirement from acting on 15 May. On 17 May, he reversed his retirement, said he had repaid more than 3 billion won in debt, and said the blackmail was continuing.

Boram Sangjo leaks personal data of around 27,000 members and enquiry customers

27kImpact: Personal information of around 27,000 members and enquiry customers

Personal information of around 27,000 members and enquiry customers was leaked at Boram Sangjo. The Personal Information Protection Commission (PIPC) imposed penalty surcharges and fines totalling around 550 million won on seven Boram Sangjo companies that leaked personal information.

Malware infections at two lending companies leak customer data

Impact: Customer information of two lending companies

At two lending companies, malware infected work PCs while they were accessing external websites, and customer information was leaked through access control vulnerabilities. The attackers used the leaked information to demand money or posted it for sale on the dark web, and also sent phishing emails impersonating the companies that promised to write off debts in exchange for cryptocurrency. On 13 May, South Korea's Financial Supervisory Service (FSS) summoned the chief executives of 20 lending companies and said it would impose strict sanctions for data leaks resulting from poor security.

Soomgo investigates suspected personal data leak after hacker threat

Soomgo received a threat from a hacker and posted a notice about signs of a suspected personal data leak. It reported the matter to the security authorities and began verifying whether data had actually been leaked. Controversy later arose over its response, centring on how the notice was given and whether mobile users were aware of the incident.

Phone numbers of 142 Minumsa customers leaked to 4,000 people by text

142Impact: Mobile phone numbers of 142 customers

The mobile phone numbers of 142 Minumsa customers were leaked after being sent to 4,000 people in a text message. Minumsa apologised for the leak of members' mobile phone numbers.

Suspicions raised over hacking of Olive Young AlimTalk messages

The possibility that Olive Young's AlimTalk notification messages were hacked was raised. Whether an actual breach occurred, the scale of the damage and the response have not been confirmed.

NEC leaks resident registration numbers while disclosing accounting records

Impact: Personal information including resident registration numbers

The National Election Commission (NEC) leaked personal information while disclosing accounting records of the Rebuilding Korea Party. The leaked information included resident registration numbers, and the scale of the damage and the response have not been confirmed.

Row over AI exposing phone number without consent

A claim was made that an AI leaked a person's phone number. The exposure of personal information without consent became controversial, and the service involved, the scale of the damage and the response have not been confirmed.

Grafana Labs source code stolen via compromised GitHub token

Impact: Leak of the company's codebase

An attacker obtained a Grafana Labs GitHub access token, downloaded its codebase and demanded money in exchange for not publishing it. A failure to rotate tokens after the TanStack npm attack was identified as the cause of the breach. Grafana Labs revoked the token and refused to pay, saying no access to customer data or damage to customer systems had been identified.

Ransomware disrupts operations at West Pharmaceutical Services

Impact: Disruption to business operations

West Pharmaceutical Services was hit by a ransomware attack that disrupted its business operations. The company disclosed the attack and subsequently began restoring operations.

American Lending Center ransomware attack exposes data of more than 120,000

123.2kImpact: Sensitive information of 123,158 people

A ransomware attack on American Lending Center in 2025 exposed the sensitive information of 123,158 people. The breach and a possible legal action came to light in May 2026. The exact date of the incident and the response measures have not been confirmed.

Cyber-attack closes some council offices in Murray County, US

Impact: Closure of some government offices and disruption to tax and vehicle registration services

Murray County in the US was hit by a cyber-attack that closed some government offices. Residents had difficulty dealing with tax and vehicle registration matters. The specific attack method and recovery measures have not been confirmed.

Škoda online shop hack leaks customer data

Impact: Online shop customer information

Škoda's online shop was hacked and customer information was leaked. Škoda disclosed the customer data breach and urged customers to be cautious.