Week 39, 2026 security incident report

Series of hacks exposes about 100,000 records at 16 Korean financial firms

100kImpact: 16 financial firms breached and about 100,000 records leaked

A series of hacks and data leaks affected South Korea's financial sector, including banks, securities firms and capital finance companies. As of 14 October, 16 financial firms had been affected and about 100,000 records had been leaked. Financial authorities held an emergency meeting across the financial sector to assess the damage, and an emergency review meeting took place on 28 October to prevent secondary harm.

Gabia Web Service Flaw Exploited, Data of 2,998 Customers Leaked

3kImpact: Personal data of 2,998 customers

An external attacker exploited weaknesses in request validation in a Gabia web service to access internal systems, leaking the personal data of 2,998 customers. Immediately after becoming aware of the incident, Gabia blocked the access route and reported it to the Korea Internet & Security Agency and the Personal Information Protection Commission. It also began a full inspection and investigation to determine whether there was further damage.

Breach at Bank of Korea Training Contractor Leaks Personal Data of 186 Employees

186Impact: Personal data of 186 employees

In May and June 2026, an external intrusion occurred in the GitHub system used by the contractor handling personal data for the Bank of Korea's online training. The names, affiliations, contact details, ranks and duties of 186 Bank of Korea employees, along with encrypted passwords, were leaked.

Hacking and data leaks at three major telecoms and cover-up allegations

Following the hacking and personal data leak incidents at the three major telecom carriers, their response systems and follow-up security measures became a subject of scrutiny in the National Assembly audit. Allegations of a cover-up, with servers disposed of after the carriers were notified of signs of hacking, and responsibility for destroying evidence were also raised as issues. Reissuing the leaked connecting information and introducing a validity period were proposed, and the possibility of additional sanctions against KT and LG Uplus was also mentioned.

Malgeunsoft Hack Reported to Have Leaked 2.37 Million Personal Records

2.4mImpact: 2.37 million reported personal data records leaked; 22 client companies affected

A hack of Malgeunsoft led to member information from online education sites being taken out. As of 13 October, the reported scale of the personal data leak is 2.37 million records, with 22 client companies affected. The affected organisations include the Korea Institute of Educational Facility Safety, where personal data of 40,000 users was leaked.

Eight More Companies Report Breaches After Musinsa Data Leak

160kImpact: Leak of 160,000 personal records from Musinsa's 29CM; eight more companies reported breaches

160,000 personal records were leaked from Musinsa's 29CM, and eight more companies reported breaches after a tip from the hacker. The government notified 30 companies named by a Chinese hacker to report breaches and carried out an investigation.

Government24 Kids Portal Hacked, Personal Data Leaked

Impact: Theft of files including a server memory dump; leak of resident registration numbers and account information suspected

On 17 August 2026, an attack through a vulnerable page on the Government24 kids portal led to the theft of files including a server memory dump. Leaks of resident registration numbers and account information were suspected, and the incident came to light about a month after it occurred. As of 29 September, the exact scale of the damage had still not been determined.

D'CENT crypto wallet hack believed to have drained 10 million XRP

Impact: About 10 million XRP believed stolen

It emerged on 24 September that a hack of the D'CENT crypto wallet had spread damage. About 10 million XRP are believed to have been stolen.

Ransomware damage suspected at SFA Engineering and Hyvision System

Suspected ransomware victims have emerged one after another in the advanced equipment industry. After SFA Engineering, Hyvision System was also named as a suspected victim.

Cord blood bank ransomware attack may have exposed babies' data

Impact: Possible leak of babies' information

A cord blood bank was hit by a ransomware attack. It was suggested that babies' information may also have been leaked.

FBI recruitment systems breached, exposing sensitive employee data

Impact: Employees’ personal information and special agents’ blood and urine test results exposed

The FBI’s recruitment website and PeopleSoft system were breached, exposing employees’ personal information and special agents’ blood and urine test results. ShinyHunters claimed to have stolen information on all employees, while the FBI launched an investigation and removed a contractor employee who had failed to apply security patches from their duties. A related suspect was subsequently arrested, and concerns were raised that US Department of Justice employees may also have been affected.

Bitget Loses About $387.5 Million in Attack on Security Product Vulnerability

Impact: About $387.5 million in crypto assets

Bitget lost about $387.5 million in crypto assets from its hot and warm wallets in an attack exploiting a zero-day vulnerability in a third-party security product. The company halted withdrawals and began an investigation, and said it would resume withdrawals from 28 September. It explained that customer account balances and cold wallets were unaffected and that the losses would be covered by its protection fund.

Arizona court hack steals personal data of over 1 million people

1mImpact: Personal data of more than 1 million people; foster child records and protective order information

The Arizona court system in the US was hit by a cyber-attack in which the personal information of more than 1 million people was stolen. The attacker copied two sets of data, and the affected material included records on foster children and protective order information. The US Federal Bureau of Investigation began investigating.

Singapore Telecoms Firm Simba Leaks Personal Data of 23,549 Customers

23.5kImpact: Names, ID numbers, dates of birth, mobile phone numbers and email addresses of 23,549 customers

Personal information of 23,549 customers was leaked from Singapore telecoms company Simba. The leaked data included names, ID numbers, dates of birth, mobile phone numbers and email addresses. The company said it had contained the incident, and Singapore's Personal Data Protection Commission has begun an investigation.

Wave of Unauthorised Access and Data Leaks at Japanese Companies

A string of unauthorised access incidents and customer data leaks has been confirmed at Japanese companies. Online security breaches at Tokyo railway operators and an information leak at an Osaka IT company were also reported. A common cause for the individual incidents, the overall scale of the damage and the specific response measures have not been confirmed.