Week 42, 2026 security incident report

Hollys membership hack exposes 2.76 million customer personal data records

2.8mImpact: Approximately 2.76 million customer personal data records

Unauthorised external access to Hollys’ membership system exposed approximately 2.76 million customer personal data records. The exposed information included user IDs, passwords, names, dates of birth, phone numbers, addresses, email addresses and duplicate registration verification information. The breach occurred in temporary files used for a system revamp, and Hollys apologised and asked customers to change their passwords.

GOPAX confirms further data leak after customer and staff information exposed

7Impact: Personal information of seven customers and two current or former employees leaked, along with a further leak of undisclosed scale

GOPAX confirmed that personal information belonging to seven customers and two current or former employees had been leaked, and identified a further leak during its investigation on 26 October. GOPAX notified the affected customers individually and apologised, stating that no abnormal withdrawals or asset losses had been identified. After receiving a separate email threatening a hack on 6 November, it suspended crypto deposits, withdrawals and trading and took protective measures to transfer assets to cold wallets, while no connection between the threat and the earlier data leak was confirmed.

Hack exposes personal data of over 400 MG insurance members

400Impact: Personal data of over 400 mutual insurance members

A hack at MG Community Credit Cooperatives exposed personal data, including names, resident registration numbers and bank account information, of over 400 mutual insurance members. MG reported the incident to the authorities and pledged full compensation for any resulting losses, while the Ministry of the Interior and Safety launched an emergency inspection with relevant agencies. Concerns were raised over an approximately 60-hour delay in detecting the incident and data being leaked through an IP address that had already been blocked, and MG subsequently moved to prevent secondary harm such as financial fraud.

OK Savings Bank Loan Application Page Hack Leaks Data of 250 People

250Impact: Personal information, account numbers, income and loan information of 250 customers

On 11-12 October 2026, abnormal access to OK Savings Bank's loan application web page led to the leak of information on 250 customers. The leaked items included names, contact details, account numbers, employer names, annual income and loan amounts. OK Savings Bank initially reported signs of a leak affecting 183 customers to financial regulators, and later confirmed the scale of the damage as 250 people.

112,890 Google accounts hacked at educational institutions across South Korea

Impact: 112,890 Google accounts at educational institutions hacked

A total of 112,890 Google accounts at educational institutions across South Korea, including schools and education offices, were hacked, exposing usernames and passwords. On 22 October, 1.39 million accounts, approximately 28% of all accounts, were found to still have unchanged passwords. A follow-up investigation found that Daejeon accounted for 74,246 compromised accounts, approximately 66% of the nationwide total, and revealed that it took two days to recognise the incident after the first signs of unusual activity and that attempts to block unauthorised apps had failed.

KDB Capital Hack Leaks Personal Data of 848 Customers

848Impact: Names, resident registration numbers and dates of birth of 848 customers

A hack at KDB Capital leaked the names, resident registration numbers and dates of birth of 848 customers. A test page that had been left undeleted served as the entry point, and KDB Capital identified the breach 101 hours after it occurred. KDB Capital pledged to prevent a recurrence.

Everest claims data theft from South Korean network security firm

Impact: Claimed theft of 263 GB of data; concerns over exposure of material relating to 75 institutions and companies

The Everest ransomware group claimed to have stolen 263 GB of data from a South Korean network security company. The claim became public on 17 October 2026, prompting concerns about the exposure of material relating to 75 institutions and companies.

Seoul impact of 1365 Volunteer Portal data breach remains unknown

A personal information breach occurred at the 1365 Volunteer Portal in May 2026. An administrative audit in November highlighted that the scale of the impact in Seoul had not been established. It also emerged that 114 of the 191 administrator accounts for the Seoul Metropolitan Government and district volunteer centres had permission to download personal information, prompting calls to improve the management of personal information and security documents.

CJ Olive Young Customer Data Leak Under Investigation as Sale Post Appears

CJ Olive Young is under investigation by the Personal Information Protection Commission (PIPC) over a customer data leak. A post on a hacking forum also appeared offering 20.8 million records for sale, but it has not been confirmed whether that number reflects the actual scale of the leak.

Suspected CyberLogitec Breach Raises Concern for 37 Maritime-Related Organisations

Impact: Suspected impact on 37 maritime-related organisations

Cydome warned of a suspected CyberLogitec breach affecting 37 maritime-related organisations. Whether the breach is confirmed, the specific information leaked, the date and the response are unknown.

Hacking of supermarket refrigeration systems in Europe causes food losses and fires

Impact: Damage to refrigeration and freezing systems in nine European countries, with food losses and some fires at hundreds of supermarkets in France

In October 2026, cyber-attacks targeting refrigeration and freezing systems at hundreds of supermarkets in France raised temperatures, causing food losses and fires. Similar incidents subsequently occurred in several other European countries, bringing the number of affected countries to nine. In November, French authorities identified Shahid Kaveh, a cyber unit of Iran's Islamic Revolutionary Guard Corps, as responsible for the attacks.

Testing agency cyber-attack exposes 7 million California students’ personal data

7mImpact: Personal information of 7 million California students

The personal information of 7 million California students was stolen in a cyber-attack on a testing agency. An account on the agency’s file transfer server was exploited to steal the data. The California Department of Education disclosed the student data breach and warned that all students enrolled since 2023 may have been affected.

Ahold Delhaize cyber-attack disrupts US and European services

Impact: Expected fourth-quarter sales reduction of €200 million–€250 million and operating profit reduction of €75 million–€100 million

Ahold Delhaize experienced disruption to online ordering, delivery and supply chain operations after shutting down systems at its US and European brands in response to a cyber-attack in October 2026. The company restored services and said there was no evidence at the time that sensitive information belonging to customers, employees or business partners had been stolen. It subsequently estimated that fourth-quarter sales would fall by €200 million–€250 million and operating profit by €75 million–€100 million, and lowered its financial outlook for 2026.

Saber Healthcare server breach affects more than 280,000 people

282.7kImpact: 282,727 people

A server breach at US-based Saber Healthcare was confirmed to have affected 282,727 people. Depending on the individual, Social Security numbers, medical and insurance information, financial account information and identification document information may have been accessed or stolen. The timing of the incident and the response measures have not been confirmed.

Parent company cyber-attack takes Giant website and app offline

Impact: Website and app operations suspended

A cyber-attack on Giant's parent company took the Giant website and app offline. Giant extended the validity period of loyalty points because of the service outage. The website and app were restored on 20 October 2026.