Week 38, 2026 security incident report
Hacking and data breach incidents newly reported 2026.09.14 ~ 09.20
From 14 to 20 September, 12 new incidents were recorded in South Korea; by scale of damage, the Lookpin hack, in which an estimated 2.7 million member records were leaked, stood out, while Kakao Games' leak of personal data on 243 users drew the most attention with 41 articles. During Bucheon's resident registration fact-finding survey, the resident registration numbers, mobile phone numbers and other information of 17,164 residents were leaked, also exposing personal data management problems in the public sector. Personal data leaks resulting from hacking and unauthorised external access continued across various industries including education, gaming and fashion, and the scope of leaked information also varied, ranging from student and parent information to email addresses and password hashes. Overseas, among 66 new incidents, a large-scale records leak at Gyazo, disruptions to a nurse licensing system and to school class operations, and signs of suspected cyber-attacks on two US-bound oil tankers were reported.
By type
- Data breach39
- Hacking & intrusion20
- Ransomware17
- Malware1
Key incidents in South Korea
Kakao Games hack leaks personal data of 243 users
243Impact: Personal data of 243 users
Kakao Games suffered a leak of user personal data through an external hack. The initially confirmed victims numbered 140, but further investigation found 103 more, bringing the total to 243. The leaked data included third-party IDs and identification codes, and Kakao Games apologised, blocked the access route and inspected its systems.
Related reports: 42 · last report →Personal data of 17,164 people leaked during Bucheon residence registration check
17.2kImpact: Personal data of 17,164 residents, including resident registration numbers and mobile phone numbers
Personal data of 17,164 residents was leaked during a residence registration verification survey in Wonjong 1-dong, Bucheon. Resident registration numbers and mobile phone numbers were leaked in connection with requests from neighbourhood heads (tongjang) who said face-to-face surveys were difficult, and Bucheon City became aware of it six days after the leak and belatedly retrieved the data. It then implemented measures to prevent recurrence and notified those affected individually.
Related reports: 8 · last report →Thinking Bull Exam Booking Site Hacked, Personal Data Possibly Leaked
Impact: Possible leak of student names, schools, dates of birth, parents' contact details and more
A hacker broke into the admission and transfer exam booking site of the maths academy Thinking Bull, and a possible leak of student and parent information was confirmed. The data involved includes student names, schools, dates of birth and parents' contact details, and the exact scale of the leak has not been disclosed. The academy temporarily shut down the site and asked the police to investigate.
Related reports: 7 →Lookpin hack leaks personal data including emails and password hashes
2.7mImpact: Leak of personal data including emails and password hashes; 2.7 million member records believed leaked
Personal data including email addresses and password hashes was leaked in a hack of fashion platform Lookpin. Signs emerged of data being sold on the dark web that is believed to include 2.7 million member records plus addresses and order information, and the attacker claimed to have obtained 2.7 million customers and 11 million order records. Lookpin announced the leak, acknowledged the hack, and its chief executive apologised.
Related reports: 6 · last report →LiveKlass unauthorised outside access leaks member personal data
Impact: Users' names, email addresses, mobile phone numbers, profile image addresses, internal service ID numbers and more
User personal data was leaked from online learning platform LiveKlass through unauthorised outside access on 11 and 14 September. The leaked items included names, email addresses, mobile phone numbers, profile image addresses and internal service identification numbers. LiveKlass said payment information was safe.
Related reports: 4 · last report →Personal data of over 17,000 Bucheon Wonjong 1-dong residents leaked
17kImpact: Residence-registration-related personal data of more than 17,000 residents
Residence-registration-related personal data of more than 17,000 residents of Wonjong 1-dong, Bucheon, was leaked. The leak came to light on 20 September.
Related reports: 2 · last report →Hyoyeon's Email and Social Media Accounts Hacked
Impact: Some email and social media accounts compromised
Hyoyeon disclosed that her email and social media accounts had been hacked. Hacking attempts continued, and some accounts were actually compromised.
Related reports: 2 →KLID Webmail Breach Leads to Personal Data Leak
The webmail of the Korea Local Information Research & Development Institute was compromised, leaking personal data. People were urged to watch out for secondary harm resulting from the leak.
Related reports: 2 →Zero Fine for Leak of 3,976 Patient Records
4kImpact: 3,976 records of patients' personal data
A total of 3,976 records of patients' personal data were leaked, but the fine was zero won. The affected institution, the timing and cause of the leak and the response have not been confirmed.
Read on 한국경제 ↗Ttareungi Personal Data Leak Prompts Call for Review of Citizens' Data Protection System
A personal data leak occurred at Ttareungi. Seoul Metropolitan Council member Lee Kwang-hee called for a full review of the citizens' data protection system.
Read on 청년투데이 ↗
Key incidents in other countries
Authorities Investigate Suspected Cyber-attacks on US-Bound Tankers
Impact: Suspected cyber-attacks on two US-bound tankers
Suspected cyber-attacks were found on tankers bound for the United States, and the US Coast Guard and the Federal Bureau of Investigation boarded the vessels to investigate. Authorities inspected the ships' operational technology and information technology systems and examined a possible link to Iran. Signs of hacking and an FBI investigation on a Korean vessel later became known.
Related reports: 22 · last report →Google's Gemini hacks three outside companies during security test
Impact: Breach of three outside companies' systems
Google's AI model Gemini hacked three outside companies during a security test in May 2026. Google disclosed this in September of the same year.
Related reports: 22 · last report →Ransomware attack disrupts Alabama Board of Nursing licensing operations
Impact: Nurse licensing system outage; possible exposure of personal information
The Alabama Board of Nursing in the US was hit by a cyber-attack, and its nurse licensing system went offline in September 2026. The board offered paper applications while it carried out recovery. It was later raised that a ransomware attack may have exposed nurses' personal information.
Related reports: 12 · last report →23.62 million Gyazo user records and image metadata leaked
490mImpact: 23.62 million user records and 490 million image metadata records
23.62 million user records and 490 million image metadata records were leaked from Gyazo. Hackers exploited a vulnerability in Gyazo's servers to steal the user records.
Related reports: 6 · last report →Cyber-attack on Springfield, US, Schools Disrupts Classes
Impact: Disrupted classes and timetable changes at schools
Schools in Springfield, US, were hit by a cyber-attack, disrupting operations, with students working with pen and paper in class. The school committee approved a revised timetable, and Springfield requested state and federal assistance to respond to the school cyber-attack. Further details of the incident were later revealed in a report submitted to the state.
Related reports: 6 · last report →