Week 43, 2026 security incident report

Bithumb groupware hack exposes data of 1,559 customers and staff

1.6kImpact: Personal data of 1,559 people exposed, including 844 customers and 715 employees and partner company staff

Bithumb announced a breach of its internal mobile system and a personal data leak on 28 October. Files containing information on 6,444 customers and 715 employees and partner company staff were exfiltrated through an intrusion into Daou Office, but data on 5,600 customers was encrypted, bringing the confirmed number of people whose personal data was exposed to 1,559, including 844 customers. Some customers' resident registration numbers, bank account numbers and copies of identification documents were exposed, and Bithumb's chief executive apologised and pledged assistance and compensation for those affected.

Pravang cyber-attack steals about 100 million won and exposes seven users' data

7Impact: Approximately 100 million won in crypto assets stolen and seven users' personal and credit information exposed

A cyber-attack on cryptocurrency exchange Pravang resulted in the theft of approximately 100 million won in crypto assets. The investigation also confirmed the exposure of seven users' personal and credit information, including login passwords, OTP keys, asset balances and personal wallet addresses. Pravang temporarily suspended its services and pledged to fully compensate customers for their losses.

Yonsei University portal hack leaks personal data of about 15,000 people

15kImpact: Personal data of about 15,000 people, including current students, alumni and staff

Yonsei University's portal service was hacked, leaking the personal data of about 15,000 people, including current students, alumni and staff. The leaked data included student ID numbers, contact details, email addresses and login IP addresses. The university requested an investigation, and police opened a preliminary inquiry.

Lotte Affiliate Giftiel Hacked, Customer Personal Data Leaked

18.4kImpact: Personal data of 18,359 customers

Giftiel, a Lotte Group affiliate that issues mobile coupons, was hacked, leaking personal data such as the names, phone numbers and refund account numbers of customers who had applied for refunds. The number of victims was confirmed as 18,359. The operator suspended the service for security fixes and said it aims to restore it on 4 November and will extend the validity of unused coupons by 30 days.

PayHub hack diverts about 200 million won in merchant settlement funds

Impact: About 200 million won in merchant settlement funds fraudulently transferred

About 200 million won in merchant settlement funds was fraudulently transferred in a hack at payment gateway provider PayHub. The company discovered the loss during an internal check for access from IP addresses linked to financial-sector hacking. Exploitation of a vulnerability in the payment and transfer request API is suspected, while the Financial Supervisory Service (FSS) has extended its on-site inspection and the Financial Security Institute (FSI) is investigating the incident.

Pukyong National University Tuition System Hack Leaks Data of 5,108 People

5.1kImpact: Personal data of 5,108 people, including 5,106 students and 2 staff members

The contractor for Suhyup Bank's Campus e-Moa system, used for tuition payments at Pukyong National University, was attacked, leaking the personal data of 5,106 students and 2 staff members. The attacker created an unauthorised administrator account to access the database. The university became aware of the incident when the attacker demanded money using the stolen data.

NOL Universe Hack Leaks Personal Data of Customers and Current and Former Employees

Impact: Personal data of customers and current and former employees

NOL Universe was hit by an external attack that leaked the personal data of customers and employees. Those affected include Interpark Tour bookers and an employee who left eight years ago. The company announced the leak on its website on 22 October, and on the 26th apologised and said it would strengthen its security systems.

Remember system glitch exposes some members' business card data

Impact: Business card information of some members

In mid-October 2026, a system glitch at Remember exposed some members' business card information in other users' card folders. The Personal Information Protection Commission launched an investigation. As of 31 October, clarifying the cause and responsibility and drawing up an organisational overhaul plan had been delayed.

Korea Foundation email systems hacked amid signs of further data leaks

The Korea Foundation’s bulk email system suffered an external attack exploiting a vulnerability on 29 July, and the foundation confirmed the breach on 19 October. On 4 November, indications of further personal data leaks were also identified in its regular email system and elsewhere. The foundation is working with the relevant authorities to establish which data was actually leaked and the extent of the leak, including email addresses, names, affiliations, telephone numbers and addresses.

Hanjin Information Systems & Telecommunication ITSM Breach Leaks 980 People's Data

980Impact: Personal data of 980 people

Personal data was leaked in a hack at Hanjin Information Systems & Telecommunication, an IT services company of the Hanjin Group. It was disclosed on 24 October 2026 that unauthorised access to its ITSM system leaked the personal data of 980 people.

GMO Internet cloud breach leaks customer data and causes trading losses

Impact: Up to 26,739 servers affected; loss compensation claims totalling 2.99 billion yen for 2,943 accounts

GMO Internet's Onamae.com Desktop Cloud suffered a malware attack that affected up to 26,739 servers, resulting in customer data leaks and asset losses from unauthorised trades. The company advised customers to shut down their PCs and offered a bounty to track down the attackers, while acknowledging that it had not adequately responded to earlier warnings about security vulnerabilities. By 12 November, claims for loss compensation totalling 2.99 billion yen had been submitted for 2,943 accounts, while the final loss amount remained undetermined.

Ukraine air raid alert app hacked to send false threat notifications

Impact: False warnings of nuclear and chemical threats and other dangers displayed in the air raid alert app

Ukraine's air raid alert app was hacked and displayed false warnings of nuclear and chemical threats, urban combat and missile deployments. Authorities said there was no actual radiation threat and announced around an hour later that the false notifications had been removed and normal system operation restored. Air raid sirens and separate warning channels continued to function normally.

Moderna-Merck Melanoma Vaccine Trial Data Leaked Ahead of Release

Impact: Some Phase 3 melanoma vaccine trial data leaked early, and share prices fell

Some Phase 3 clinical trial data on the Moderna and Merck melanoma vaccine leaked before the official announcement. The two companies released the clinical data early after the leak. Both companies' shares fell around the leak, and Moderna's share price appeared to stabilise on 27 October.

Chainalysis breach exposes all users’ credentials

Impact: Exposure of all users’ credentials and active tokens

An external attacker gained access to Chainalysis’s internal systems and tools, exposing customer names, email addresses, user IDs and other information. The company disclosed the incident on 30 October, notified customers and began an investigation with external experts, initially saying it had found no evidence of unauthorised access to credentials or session tokens. It subsequently confirmed that all users’ credentials and active tokens had been exposed, as well as password hashes and some customers’ passwords. Major services were disrupted, and service restoration began on 6 November.

State Bank of India customer data leaked on dark web

375kImpact: Indications that records relating to approximately 375,000 customers were stolen and circulated

State Bank of India launched an investigation after being notified that material on the dark web contained 3,897 customer records, and individually notified affected customers. The leaked material included names, contact details, addresses, dates of birth, customer identifiers and metadata from loan-related records. On 14 November, further details of a police investigation emerged indicating that records relating to approximately 375,000 customers had been stolen and circulated following a breach of the bank’s global IT centre in Navi Mumbai.