Week 21, 2026 security incident report
Hacking and data breach incidents newly reported 2026.05.18 ~ 05.24
From 18 to 24 May 2026, 11 new incidents were recorded in South Korea, with the CJ Group case, in which photos, phone numbers, family photos and other information of about 330 female employees were leaked on Telegram, drawing the most attention with 49 articles. Data leaks continued at companies and public services, including the leak of personal details and photos of 2,000 female employees of a major company and the leak of personal data on 930 users of the 1365 Volunteer Portal, while celebrity accounts were hacked and the May 18 Memorial Foundation website suffered an outage suspected to be caused by a DDoS attack. Across all types in South Korea and abroad, personal data leaks were the most common at 30, followed by ransomware at 9 and hacking/intrusions at 8. Overseas, among 39 new incidents, leaks involving 3,800 GitHub internal repositories and information on more than 185,000 7-Eleven customers stood out, and chain damage spreading from Beacon Mutual to the State of Rhode Island was also confirmed.
By type
- Data breach28
- Hacking & intrusion8
- Ransomware8
- DDoS2
- Malware1
Key incidents in South Korea
Personal data of 330 female CJ Group employees leaked on Telegram
330Impact: Personal information of about 330 female employees, including photos, phone numbers and family photos
Personal information of about 330 female CJ Group employees, including photos and phone numbers, was leaked on Telegram, along with family photos. The leaked data was traded through a US$100-a-month subscription paid in cryptocurrency. CJ filed a complaint with the police, and after an investigation the police referred a former employee who leaked the data to prosecutors.
Related reports: 49 · last report →Miryang sexual assault victim booked for allegedly leaking perpetrators' information
Impact: Personal information of the perpetrators in the Miryang gang rape case
A victim of the Miryang gang rape case was booked by police on charges of leaking the perpetrators' personal information to a YouTuber. Police are preparing to refer the case to prosecutors. The specific types and amount of personal information leaked and when it was leaked have not been confirmed.
Related reports: 8 · last report →May 18 Memorial Foundation website disrupted by suspected DDoS traffic
Impact: Website access disruption
On 19 May 2026, signs of a suspected DDoS attack were detected on the press release board of the May 18 Memorial Foundation's website, with numerous IP addresses of unknown origin accessing it repeatedly. The website suffered access disruptions, and the foundation responded by blocking the repeatedly accessing IP addresses and applying rate limits. Police opened a preliminary investigation, and whether it was an attack and who was behind it are still being determined.
Related reports: 7 · last report →External attack on 1365 Volunteer Portal leaks personal data of 930 users
930Impact: Personal information of 930 users
The government-run 1365 Volunteer Portal was hit by an external attack that leaked the personal information of 930 users. The IP addresses used in the attack were blocked.
Related reports: 4 · last report →Jeong Ju-ri's Google account hacked, YouTube channel deletion notice
Impact: Jeong Ju-ri's Google and YouTube accounts compromised
Jeong Ju-ri revealed that her Google account had been hacked and asked acquaintances to ignore any requests for money. She later said she had received a notice that her YouTube channel would be deleted and appealed for her account to be returned. On 3 June 2026, it was reported that she had regained her YouTube account after around three weeks.
Related reports: 4 · last report →International hacking ring that targeted Jungkook and conglomerate executives via SIM cloning arrested
An international hacking ring targeted Jungkook and 22 executives of major companies, among others, using SIM cloning and unauthorised phone activation. Jungkook suffered no financial loss thanks to his agency's response. Members of the ring were arrested.
Related reports: 4 →Fine standards for personal data leaks to be tightened from 19 May
The standards for fines on personal data leaks will be tightened from 19 May. The previous standards will apply to KT, and projections suggested fines of up to 200 billion won are possible. Whether a fine will actually be imposed and the amount have not been confirmed.
Related reports: 2 →Personal details and photos of 2,000 female employees at major company leaked
2kImpact: Personal details and photos of 2,000 female employees
The personal details and photos of 2,000 female employees of a major company were leaked. Signs of a hack of the internal network emerged.
Read on 글로벌E ↗Personal information of 330 female CJ employees leaked
330Impact: Personal information of 330 female employees
The personal information of 330 female employees of CJ was leaked. When the incident occurred, how the leak happened and the response measures have not been confirmed.
Read on The Korea Times ↗Yang Bae-cha's social media account hacked
Impact: Hack of Yang Bae-cha's social media account
After falling victim to jeonse lease fraud, Yang Bae-cha also had a social media account hacked. Yang said the number of followers actually increased after the hack; account recovery and other responses have not been confirmed.
Read on TV리포트 ↗
Supply-chain breaches
Beacon Mutual ransomware attack exposes data of 4,500 current and former state employees
4.5kImpact: Information of 4,500 current and former Rhode Island state employees
Beacon Mutual was hit by a ransomware attack that exposed the information of 4,500 current and former Rhode Island state employees. The attack became known in February, and the company began notifying victims in May.
Related reports: 2 · last report →
Also affected: 1- State of Rhode IslandBeacon Mutual ransomware attack exposes data of 4,500 Rhode Island state employeesInformation of 4,500 current and former state government employees
Key incidents in other countries
Malicious extension infection leads to theft of 3,800 GitHub internal repositories
Impact: Data from 3,800 internal repositories
GitHub confirmed that data from 3,800 internal repositories was stolen in a breach carried out through a malicious Visual Studio Code extension. The infection occurred through an internal employee's device, and GitHub said customer data was not affected. TeamPCP, which claimed the attack, later took bids for the stolen data.
Related reports: 15 · last report →7-Eleven hack exposes personal data of over 185,000 people
185kImpact: Personal data of more than 185,000 people leaked
7-Eleven confirmed a data breach following a hack and ransom demand by ShinyHunters. The leaked data included franchisee information and Salesforce records, and more than 185,000 people were reportedly affected by the personal data breach. On 1 June 2026, it came to light that legal action had been brought over the exposure of 600,000 records.
Related reports: 12 · last report →CISA passwords and cloud keys exposed
Impact: Exposure of passwords and cloud keys including Amazon Web Services GovCloud keys
Passwords and cloud keys belonging to the US Cybersecurity and Infrastructure Security Agency were exposed on the public web via GitHub and other channels. The exposed material included Amazon Web Services GovCloud keys. The leaked material was taken down, and members of the US Congress demanded explanations and answers from the agency.
Related reports: 10 · last report →Trump Mobile customer names, contact details and delivery addresses exposed online
Impact: Personal information of thousands of pre-order customers
A personal data exposure affecting thousands of customers who pre-ordered Trump Mobile's T1 mobile phone came to light. Customer names, email addresses, delivery addresses, phone numbers and order identifiers were exposed on the internet. The company said the problem involved a third-party operations support supplier and began investigating and reviewing whether affected customers need to be notified.
Related reports: 10 · last report →Hack of New York City public hospital system leaks medical and biometric data
1.8mImpact: Medical records, fingerprints and location data of about 1.8 million people
A hack of New York City's public hospital system leaked information on about 1.8 million people. The leaked information included medical records, fingerprints and location data.
Related reports: 6 · last report →