Week 22, 2026 security incident report
Hacking and data breach incidents newly reported 2026.05.25 ~ 05.31
From 25 to 31 May, four new incidents were recorded in South Korea, with the TVING hack that leaked 39.54 million accounts drawing the most attention with 426 articles. South Korea's major cases all related to personal data leaks, including a fine imposed on Misotech over the leak of 570,000 personal data records, a complaint filed against a candidate by the Democratic Party's South Jeolla Provincial Chapter, and a decision not to indict a manager who is Park Na-rae's ex-boyfriend over an alleged personal data leak. By type overall, personal data leaks (32) outnumbered hacking/intrusions (19) and ransomware (3), and chain damage spreading from Carnival to Holland America Line was also confirmed. Overseas, 50 new incidents were recorded, with large-scale data leaks standing out, including the leak of personal and health information on more than 15 million people at DentaQuest, the exposure of 4.9 million accounts' information at Charter Communications and the theft of more than 600,000 Lithuanian national registry records.
By type
- Data breach30
- Hacking & intrusion17
- Ransomware3
Key incidents in South Korea
TVING hack leaks information on 39.54 million member accounts
Impact: Information on 39.54 million accounts leaked, of which 22.06 million were active accounts
TVING was hacked, and members' personal information such as phone numbers and dates of birth was leaked. A government investigation found 39.54 million leaked accounts, of which 22.06 million were active, and pointed to poor access key management. TVING urged users to change their passwords and apologised, and pursued increased information security investment, compensation and a more advanced security system.
Related reports: 427 · last report →Misotech fined over leak of 570,000 personal data records
570kImpact: 570,000 personal data records
570,000 personal data records were leaked from Misotech. The Personal Information Protection Commission (PIPC) imposed a fine on Misotech.
Read on 블로터 ↗Democratic Party's South Jeolla branch files complaint against candidate over personal data leak
The Democratic Party of Korea's South Jeolla Province branch filed a criminal complaint against Kim Tae-seong, a candidate for Sinan County head. It cited a leak of personal information as the grounds for the complaint.
Read on 연합뉴스 ↗Park Na-rae's ex-boyfriend cleared over alleged leak of manager's personal data
Park Na-rae's ex-boyfriend was cleared of allegations that he leaked a manager's personal data. Whether personal data was actually leaked and the extent of any damage have not been confirmed.
Read on 스포츠동아 ↗
Supply-chain breaches
Carnival staff account takeover exposes data of around 5.99 million people
6mImpact: Personal data of around 5.99 million people
A social engineering attack targeting employee accounts at cruise operator Carnival led to the leak of personal data of around 5.99 million travellers. Carnival disclosed the data breach in May 2026. A class action was filed over delays in notifying customers, and Texas authorities opened an investigation into the incident, which affected more than 800,000 residents.
Related reports: 45 · last report →
Key incidents in other countries
DentaQuest hack leaks personal data of more than 15 million people
15mImpact: Personal and health information of more than 15 million people
A cyber breach at DentaQuest in May 2026 led to the leak of personal and health information. Initially, a leak of information from about 2.6 million accounts was reported, and ShinyHunters claimed to have stolen 234 GB. The potential scope of impact was later put at more than 23 million people, and in August the damage was reported as affecting more than 15 million. DentaQuest began notifying victims, and related class action lawsuits were filed.
Related reports: 15 · last report →Obama-era White House Instagram account hacked
Impact: Takeover of the Obama-era White House Instagram account and publication of false posts
The White House Instagram account from Barack Obama's presidency was hacked, and false posts and AI-generated images were published on it. The attacker gained access to the account by tricking Meta's AI support chatbot, and the false posts were deleted. More than 20,000 Instagram users were affected by the same hack.
Related reports: 15 · last report →Row over Nigel Farage's claim of Russian phone hacking
Nigel Farage claimed his phone had been hacked by Russia, but security experts said the claim lacked evidence. The Labour Party demanded that Farage report it to the police and present evidence. Labour later reported the hacking allegation to the police and security authorities, and whether a hack actually took place has not been confirmed.
Related reports: 9 · last report →Over 600,000 Lithuanian state registry records stolen
600kImpact: More than 600,000 state registry records and data on people equivalent to around 20% of the population
Login credentials issued to authorised user organisations of Lithuania's state registry system were abused, and more than 600,000 records were stolen. The leaked data included names, dates of birth, national identification numbers and property addresses. Prosecutors are investigating possible foreign involvement.
Related reports: 8 · last report →Charter Communications breach exposes 4.9 million accounts
Impact: Data of 4.9 million accounts exposed, according to the company
Charter Communications confirmed a data breach, and ShinyHunters used the stolen data to blackmail the company. The attackers claimed to have leaked 40 million customer records, and it was later reported that more than 13 million had been published. The company put the damage at 4.9 million accounts, and on 2 June the number of leaked records was given as 42 million.
Related reports: 7 · last report →