Week 35, 2026 security incident report

Musinsa's 29CM customer data leak of 159,852 records, with more later confirmed

159.9kImpact: 159,852 customer records plus 30,000 additional records

Abnormal access to the order lookup API at 29CM, operated by Musinsa, leaked 159,852 customer records. Most included only names, while about 20,000 included contact details, shipping information, email addresses and more. The company apologised, and in October 2026 a further leak of 30,000 personal records became known.

China-linked hacking group's attacks also hit South Korean companies

Impact: Four South Korean and US companies affected, including a South Korean financial firm

A China-linked hacking group ran a wide-ranging hacking operation targeting the US Department of Justice, the Federal Reserve, the Senate, NASA and others. Four South Korean and US companies, including a South Korean financial firm, were also affected. The US government detected and blocked the hacking operation.

Intrusion into affiliates via HD Korea Shipbuilding & Offshore Engineering server leaks personal data

9.5kImpact: Personal information of 9,503 people

An HD Korea Shipbuilding & Offshore Engineering server was used as a hacking route, leading to intrusions into HD Hyundai affiliates and the leak of personal information of 9,503 people. The affiliates concerned were hit with fines and penalties totalling 78.3 million won.

Personal data of about 630 people at Daejeon Dong-gu Global Dream Campus leaked

630Impact: Personal information of about 630 people, 83% of students

A personal data leak at a major language institute also exposed information on users of the Daejeon Dong-gu Global Dream Campus. About 630 people were affected, equal to 83% of its students.

29CM data breach exposes personal information of around 160,000 customers

160kImpact: Approximately 160,000 records of customer personal information

Personal information of 29CM customers was leaked in an attack in late August that exploited a vulnerability in its customer information lookup API. Initial reports put the number of affected customers at 159,000, while a subsequent tally put the total at approximately 160,000 records.

HD Construction Equipment leaks personal data of 9,503 employees

9.5kImpact: Personal information of 9,503 employees

Personal information of 9,503 employees was leaked from HD Construction Equipment. The incident resulted in a fine of 73.5 million won.

Daehang Hospital website hack suspected of leaking member data

Impact: Personal information of some members and their online consultation requests and enquiries

On 14 August 2026, an outsider gained unauthorised access to customer data on the Daehang Hospital website, and signs emerged that some member information had been leaked. The leaked items included names, user IDs, dates of birth, mobile phone numbers, email addresses, and online consultation requests and enquiries.

Marketing platform Mecros leaks names, phone numbers, CI and IP addresses

Impact: Personal information including names, phone numbers, CI and IP addresses

Personal information including names and phone numbers was leaked from the marketing platform Mecros. The leaked data also included CI, a personal identifier, and IP addresses.

Venture fund administrator Mira Partners suffers personal data leak

Personal information was leaked from Mira Partners, an administrator for venture funds. It is unclear whether the leaked data included encryption keys.

HD Hyundai affiliates leave server connections in place, leaking personal data

Personal information was leaked because HD Hyundai affiliates left unnecessary connections between affiliate servers in place. The Personal Information Protection Commission (PIPC) sanctioned two HD Hyundai affiliates over the leak.

Boston Scientific Cyber-attack Disrupts Global Operations

Impact: Disruption of global order processing, shipping and product manufacturing; lowered earnings outlook

Boston Scientific was hit by a cyber-attack that disrupted global order processing and shipping as well as product manufacturing. After the operational disruption was reported in late August, it was expected in September that the company would struggle to meet its sales and profit forecasts. In October, the company lowered its earnings outlook again, citing the aftermath of the cyber-attack and other business factors.

McKesson cyber-attack exposes customer data and email addresses

Impact: Customer data including 6.4 million unique email addresses

Pharmaceutical distributor McKesson had customer data stolen in a cyber-attack involving a third-party application, and also suffered service degradation. The attackers claimed to have taken 284 million records, and it was later confirmed that the stolen material included 6.4 million unique email addresses. McKesson narrowed the confirmed data theft to oncology and multispecialty customers and promised to notify patients.

ATF Investigative Information System Breached

Impact: Breach of a system containing information on investigative subjects; claimed publication of 6.3 GB of investigation files

A system containing information on investigative subjects at the US Bureau of Alcohol, Tobacco, Firearms and Explosives was breached. With the Qilin ransomware group claiming the attack, the agency classified it as a major cyber security incident and investigated. Investigation-related files were later published, and it was also reported that Qilin published 6.3 GB of files and took them down within 24 hours.

Manchester Airports Group hack leaks data of 8.8 million people

8.8mImpact: Data of 8.8 million people leaked

Manchester Airports Group was hit by a cyber-attack that exposed customer data. The initial scale was reported as 8.7 million people, but a leak of data on 8.8 million people was later confirmed. The attackers published the data after their extortion demand was rejected.

Berlin government network hack leaks 1.4 million files to dark web

Impact: 1.4 million files leaked to the dark web

Berlin's government network was hacked and data was stolen, with the attackers demanding 2 million euros and threatening to publish the data. Berlin refused to pay, and the Rhysida ransomware group published the stolen material. An investigation into the leak of login credentials followed, and the files published on the dark web were reported to number 1.4 million.