Week 44, 2026 security incident report
Hacking and data breach incidents newly reported 2026.10.26 ~ 11.01
From 26 October to 1 November, 60 new incidents were recorded in South Korea; among the major cases, the hack of a Daishin Securities server linked to account opening, which leaked eight categories of personal data on 38,490 customers, received the most coverage. Breaches in the financial sector followed in succession, including at Mirae Asset Life Insurance and Mirae Asset Global Investments, and personal data leaks also occurred at apartment community, aviation, travel and welfare services, highlighting damage to sensitive information such as resident registration numbers, account numbers and passport information. Across all types, personal data leaks were the most common at 172, and in South Korea, chain damage spreading from Douzone Bizon to hospitals, public institutions, publishers and others, as well as chain damage via Daehong Communications, Money Today and Hanwha Systems, stood out. Overseas, among 229 new incidents, about $6.4 billion in crypto asset losses from a Binance hot wallet hack drew major attention, and a leak of US Department of Homeland Security employee information and disruptions to medical, teaching and research operations at the University of New Mexico were also reported.
By type
- Data breach166
- Hacking & intrusion53
- Ransomware31
- Malware9
- Phishing & smishing5
- DDoS1
Key incidents in South Korea
Financial Security Institute cyber-attack exposes data from 48 financial firms
350Impact: An estimated 130 or more files from 48 financial firms leaked, along with approximately 200 administrative forms, more than 300 personal information entries and more than 350 system user information records
The Financial Security Institute detected a data leak from its continuous information security assessment system at around 3 pm on 9 November, blocked access and reported the incident to the Financial Services Commission (FSC) and the Korea Internet & Security Agency (KISA). An estimated 130 or more files from 48 financial firms were leaked, along with approximately 200 administrative forms, more than 300 personal information entries in those forms and more than 350 system user information records. The attacker bypassed SMS verification to create an account impersonating the Financial Supervisory Service and exploited inadequate access authorisation checks in an operational inspection feature. The institute blocked 246 attacking IP addresses, while the FSC launched an on-site inspection and announced a targeted audit.
Related reports: 169 · last report →Mirae Asset Securities breach affects about 3,800 customers and 35,255 personnel
35.3kImpact: Account numbers of about 3,800 customers and personal information of 35,255 employees, former employees and outsourced staff
Mirae Asset Securities suffered attacks on 4 and 5 November, exposing account numbers belonging to about 3,800 customers and personal information belonging to 35,255 employees, former employees and outsourced staff. The attacks targeted its mobile web login service using mobile phone authentication and its groupware, with the leaked personnel information including names, email addresses, mobile phone numbers and encrypted passwords. The Financial Supervisory Service (FSS) began an on-site inspection and confirmed connections between several attacks.
Related reports: 119 · last report →Daishin Securities hack exposes information on over 38,000 customers
38kImpact: Personal information of over 38,000 customers
A hacking incident at Daishin Securities on 27 October exposed information on over 38,000 customers. The exposed information included addresses and encrypted account numbers, and Daishin Securities said there had been no resulting harm. On 9 November, the company announced support measures for affected customers, including one year of insurance covering up to KRW 10 million in losses from voice phishing and smishing, a waiver of trading fees for Korean shares in December, and a cash payment of KRW 10,000.
Related reports: 81 · last report →GS E&C apartment community system hacked, exposing residents’ data
Impact: Personal information of some apartment residents; affected complexes and number of people under investigation
GS Engineering & Construction’s apartment community facility booking and management system was hacked, exposing some residents’ personal information. The affected complexes and number of people are under investigation, with addresses, encrypted passwords, administrator IDs and RF card numbers among the information potentially exposed. After GS E&C declined to consent to an investigation by the Korea Internet & Security Agency (KISA), citing its own investigation, the Ministry of Science and ICT decided on 11 November to launch an ex officio investigation into the cause and scale of the incident.
Related reports: 58 · last report →Hanyang Securities groupware hack exposes 31 personal information records
31Impact: 31 personal information records involving customers, employees and others, including three records exposing resident registration numbers
An external groupware platform used by Hanyang Securities was hacked, exposing a total of 31 records: 15 containing customer information, two containing employee-related information and 14 containing general personal information. The exposed information included names, resident registration numbers, driving licence numbers and bank account numbers, with resident registration numbers exposed in three records. Hanyang Securities said an insufficient access control vulnerability in Daou Office was the direct cause and that the breach occurred before a patch was released. It is now considering building its own business system.
Related reports: 43 · last report →Mirae Asset Life Insurance cyber-attack exposes customer, retirement pension and employee data
Impact: Customers' personal information, retirement pension transaction data and employee information
A leak of customers' personal information following a cyber-attack at Mirae Asset Life Insurance was confirmed on 26 October. In addition to names, resident registration numbers and bank account numbers, retirement pension transaction data and employee information were also confirmed to have been exposed. The company undertook emergency response and recovery work, while the closure of its website disrupted access to some online services. The Financial Supervisory Service extended its on-site inspection as the scope of the damage changed.
Related reports: 38 · last report →HYBE cyber-attack exposes employee and partner personal data
Impact: Personal information belonging to some current and former personnel and partner company representatives, as well as internal documents
Unauthorised access to HYBE’s internal systems occurred on two occasions, 12–13 September and 3–5 October, exposing internal documents and personal information belonging to some current and former personnel and partner company representatives. Evidence of intrusion through an external document preview solution linked to the electronic approval system and through the expense processing system was confirmed, and the exposed information included resident registration numbers, passport numbers, bank account numbers, card numbers and medical information. HYBE apologised, and police launched a preliminary inquiry on 3 November.
Related reports: 36 · last report →Gmarket API flaw exploited to leak personal data and misuse e-coupons
900kImpact: 900,000 people reported as affected by the personal data leak
On 28–29 October, unauthorised access exploiting a vulnerability in an external service API at Gmarket exposed customers' personal data and e-coupon PINs, and some e-coupons were used without authorisation. The exposed data included names, user IDs, phone numbers, email addresses and addresses. The company blocked the access route, reported the incident to the Korea Internet & Security Agency (KISA) and requested a police investigation; on 1 November, it completed full compensation for losses from unauthorised use and payments of 10,000 won in Smile Cash to customers whose personal data was exposed, while replacement of gift voucher PINs was underway.
Related reports: 34 · last report →DOUZONE BIZON server breach raises wider concerns over client data exposure
Impact: As of 5 November, 28 companies and institutions had issued notices of possible personal data leaks; the actual scale of any leak remains unconfirmed
Two security breaches were confirmed at DOUZONE BIZON, raising the possibility that personal data belonging to client companies and third parties whose data those clients held may have been leaked. Historical records of companies whose services had ended may also have been affected, and as of 5 November, 28 companies and institutions had issued notices of possible data leaks. DOUZONE BIZON voluntarily reported the incidents to the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission (PIPC) and disclosed progress on security investments totalling 16 billion won. The government deemed the incidents serious and launched a joint public-private investigation, while whether data was actually leaked and the extent of any leak remain under investigation.
Related reports: 27 · last report →Jin Air cyber-attack exposes personal data of 1,454 members
1.5kImpact: Eight categories of personal data belonging to 1,454 members
An external attack targeting Jin Air’s member information lookup API exposed eight categories of personal data, including names and telephone numbers, belonging to 1,454 members. Passwords and payment information were not compromised. Jin Air announced the breach on 29 October, blocked the attacking IP addresses and access to the systems involved, and said it would notify affected customers individually. Questions subsequently arose about internal system problems and whether responsibility for the incident contributed to the chief executive’s resignation, while further system reviews continued.
Related reports: 24 · last report →
Supply-chain breaches
Amplitude Internal System Breach Affects Customer Data
Impact: Event data of less than 0.3% of all customer accounts
Amplitude detected and blocked unauthorised access to some of its internal systems on 28 September. Event data belonging to less than 0.3% of all customer accounts was affected, and the specific leaked items and number of people have not been disclosed. The company disclosed the incident in a customer security notice on 28 October.
Read on Ally Security ↗
Also affected: 1- CoinbaseAmplitude Breach Exposes Coinbase Customer Contacts and Transaction DataContact details and limited transaction data of some customers exposed; number of victims not disclosed
Breach at Booking Supplier for Swedish Attractions Exposes Visitor Data
Impact: Visitors' names, addresses, phone numbers, email addresses and booking- and purchase-related information
Visit, the booking supplier for Swedish attractions Liseberg and Skansen, was breached, exposing visitors' personal data. The exposed data included names, addresses, phone numbers, email addresses and booking- and purchase-related information. Payment card information was not included.
Read on eBuilder Security ↗
Also affected: 1- LisebergData of About 15,000 Liseberg Users in Sweden ExposedNames, contact details and booking-related information of about 15,000 users
Amadeus reservation system breach exposes passenger data at multiple airlines
Impact: Passenger booking data exposed at multiple airlines
Unauthorised access to the reservation system of Spanish travel technology company Amadeus exposed passenger booking data at multiple airlines. Alongside names and itinerary details, some passport numbers and contact details were exposed, with Japan Airlines, ANA and Cathay Pacific among the affected airlines. Further reports followed from Korean Air, Asiana Airlines and others, while Thailand's aviation authorities confirmed that Thai Airways and Bangkok Airways were affected among seven major airlines.
Related reports: 9 · last report →
Also affected: 11- Korean AirAmadeus breach exposes 106,661 Korean Air customer booking records106,661 customer booking records (PNRs)
- Cathay PacificAmadeus breach exposes about 53,000 Cathay Pacific bookingsData on about 53,000 bookings
- Japan AirlinesJapan Airlines supplier hack leaks data on about 92,000 customersInformation on about 92,000 customers
- All Nippon AirwaysAmadeus Breach May Have Exposed ANA Customer Booking DataBooking data of about 37,800 customers affected
- Malaysia AirlinesAmadeus breach may have exposed Malaysia Airlines customer data
- QantasQantas investigates booking data impact from Amadeus breach
- Singapore AirlinesAround 46,000 Singapore Airlines booking records accessed without authorisationApproximately 46,000 booking records
- NH NongHyup TravelEvidence of customer flight booking number leak at NH NongHyup Travel
- FinnairAmadeus breach exposes around 116,000 Finnair bookingsAround 116,000 bookings within the scope of exposure; around 750 actually viewed
- Thai AirwaysAmadeus breach exposes about 60,529 Thai Airways booking recordsApproximately 60,529 passenger booking records affected, with around 376 potentially containing additional personal information
- NorwegianEarlier Amadeus breach exposed data of 144,249 Norwegian and Widerøe passengersInformation belonging to 144,249 passengers
Benefit One Discount Service Leaks Data of 29,465 Members
29.5kImpact: Personal data of 29,465 users
Unauthorised access to the systems of the contractor for Benefit One's Tokukai discount service from 14 to 20 October leaked the personal data of 29,465 users. The leaked information included, depending on the member, name, date of birth, email address and customer number. The service was temporarily suspended, and credentials used to link to the payment system were also changed after they were found to be possibly leaked.
Related reports: 2 · last report →
Also affected: 1- Credit Saison Co., Ltd.Personal Data of 29,465 Users of Saison Card Perks Service LeakedPersonal data of 29,465 Toku-Kai users
US education software breach exposes data on 1.3 million people
1.3mImpact: Personal information on more than 1.3 million students and staff
A vulnerability in third-party software was exploited at a US education administration software company, exposing personal information on more than 1.3 million students and staff. The attacker gained access on 14 August 2026, and the stolen information included Social Security numbers, dates of birth, identification document numbers and health insurance information.
Read on IANS ↗
JapanTicket external analytics tool breach leaks customer data
264kImpact: Up to about 264,000 customer records
Unauthorised access to an external analytics tool used by JapanTicket leaked up to about 264,000 customer records. The leaked data included names, email addresses, phone numbers, countries, and booking and order details, but not card numbers. The company is also investigating whether about 70,000 bookings for the 2024 Mt. Fuji Yoshida Trail passage are included.
Related reports: 3 · last report →
Also affected: 1- Yamanashi PrefectureData on About 70,000 Mount Fuji Trail Reservations in Yamanashi Possibly LeakedPossible leak of about 70,000 records of information on users who reserved on the Mount Fuji Yoshida Trail
Taiwan's 91APP order database breach may expose data of 4.8 million consumers
4.8mImpact: Potential exposure of information on 4,798,255 consumers across up to 1,329 brands
A breach of Taiwanese e-commerce platform 91APP's order database raised concerns that 4,798,255 consumers across up to 1,329 brands could be affected. Names, telephone numbers, delivery addresses, email addresses and order histories were potentially exposed, but the actual extent of unauthorised access or theft has not been confirmed. 91APP allowed consumers to apply for compensation even without financial losses and moved the application channel from Google Forms to its official website. Taiwan's Ministry of Digital Affairs suggested a link to the AI hacking tool ARTEX.
Related reports: 27 · last report →
Also affected: 2- MUJI Taiwan91APP breach may have leaked order data of about 180,000 MUJI Taiwan membersPossible leak of online order data of about 180,000 members
- COSMEDCOSMED affected by cyber-attack on 91APP
Daehong Communications Leaks Data of 18,359 Customers, Coupon Service Suspended
18.4kImpact: Personal data of 18,359 customers leaked; use of mobile coupons for 24 brands restricted
The personal data of 18,359 customers was leaked from Daehong Communications, and no financial damage has been confirmed. The suspension of the Giftiel service restricted the lookup, use, approval and cancellation functions of mobile coupons for 24 brands. The operator extended coupon validity by 30 days and worked on recovery, aiming to normalise the service on 4 November.
Related reports: 3 · last report →
Also affected: 1- Lotte GRSGiftiL hack disrupts Lotte Eatz membership couponsDisruption to Lotte Eatz membership coupon use
Unauthorised access to MoneyToday exposes 1,367 personal data records
1.4kImpact: 1,367 personal data records
MoneyToday suffered a leak of 1,367 personal data records following unauthorised external access. The leaked information included the English names and work telephone numbers of applicants to the the300 Policy Academy, as well as the company names and job titles of newsletter subscribers. The access route was blocked on 25 September, and a follow-up review on 27 October established the scale of the leak; the Personal Information Protection Commission (PIPC) is investigating.
Related reports: 9 · last report →
Also affected: 1- Donghaeng Media SidaeMoney Today Hack Leaks 526 Donghaeng Media Sidae Subscriber Records526 subscriber personal data records
KDDI customer data may have leaked through Lifenet Insurance system
22.5kImpact: Possible leak of 22,541 KDDI customer records
Exploitation of a vulnerability in Lifenet Insurance’s KDDI-linked system was found to have potentially exposed 22,541 KDDI customer records. The information concerned includes names, postcodes, telephone numbers, email addresses and member identifiers. Some insurance application functions were also suspended.
Related reports: 2 · last report →
Also affected: 1- KDDIUp to 22,541 KDDI customer records may have leakedPossible leak of up to 22,541 customer records
DOUZONE BIZON server breach raises wider concerns over client data exposure
Impact: As of 5 November, 28 companies and institutions had issued notices of possible personal data leaks; the actual scale of any leak remains unconfirmed
Two security breaches were confirmed at DOUZONE BIZON, raising the possibility that personal data belonging to client companies and third parties whose data those clients held may have been leaked. Historical records of companies whose services had ended may also have been affected, and as of 5 November, 28 companies and institutions had issued notices of possible data leaks. DOUZONE BIZON voluntarily reported the incidents to the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission (PIPC) and disclosed progress on security investments totalling 16 billion won. The government deemed the incidents serious and launched a joint public-private investigation, while whether data was actually leaked and the extent of any leak remain under investigation.
Related reports: 27 · last report →
Also affected: 24- Asan Chungmu HospitalAsan Chungmu Hospital warns business partner data may have leaked in external backup server breachPossible leak of business partners' account details and other data
- National Museum ComplexDOUZONE BIZON hack raises data leak concerns at National Museum ComplexPotential leak of personal information, including resident registration numbers and bank account numbers; scale unconfirmed
- ChangbiChangbi warns of possible author and business partner data leak after Douzone Bizon cyber-attack
- Changbi EducationChangbi Education authors' and business partners' personal data possibly leaked
- Charmzone AutomotiveCharmzone Automotive customers' personal data possibly leaked
- PetdocPetdoc's former Hairu employees' and business partners' data possibly leaked
- WithYouWithYou notifies of possible leak of employees' personal data
- Jaewon FoodJaewon Food employees' and franchise owners' personal data possibly leaked
- Korea Ladies Professional Golf AssociationKorea Ladies Professional Golf Association members' personal data possibly leaked
- Chuncheon Cultural FoundationChuncheon Cultural Foundation personal data possibly leaked via external backup server breach
- K AuctionK Auction personal data left in backups after service termination possibly leaked
- Korea Airport SecurityKorea Airport Security faces possible data leak linked to Douzone Bizon hack
- Sunghyun Accounting CorporationDouzone Bizon server breach sparks fears of Sunghyun data leak
- KukkiwonDOUZONE BIZON backup server breach raises concerns over Kukkiwon data leak
- Theborn KoreaTheborn Korea warns of possible personal data leak after supplier server breach
- Jeonbuk Culture & Tourism FoundationJeonbuk Culture & Tourism Foundation warns of possible leak of staff personal dataPossible leak of resident registration numbers, account numbers, payroll and HR information of employees, business partner staff and others
- KEPCO ESKEPCO ES warns of possible personal data leak following DOUZONE BIZON hackPossible leak of personal information, including resident registration numbers and contact details
- Seoul Support Center for ChildcareSeoul childcare support centre warns of possible staff and instructor data leakPossible leak of personal information, including resident registration numbers and bank account numbers, belonging to current and former employees, instructors and others
- Gwangju Foundation for Women & FamilyGwangju Foundation for Women & Family warns of possible data leak from external backup server
- KAC Airport ServiceKAC Airport Service warns of possible data leak linked to Douzone Bizon breach
- T1Douzone Bizon backup service breach may expose T1 players' personal dataPotential leak of resident registration numbers, passport numbers and salary records belonging to players and others
- Jeonnam Information & Culture Industry Promotion AgencyDouzone Bizon backup service breach raises data leak concerns at Jeonnam agency
- AgileSoDAAgileSoDA staff data potentially exposed in external backup server breachPossible exposure of employees' and executives' unique identification data, financial information, and personnel, payroll and tax records
- Gwangju Tourism OrganizationGwangju Tourism Organization warns of possible data leak following DOUZONE BIZON breachPossible leak of personal information held by an outsourced service
Hanwha Systems ICT Unit Breach Leaks Employee Personal Data
1.7kImpact: Leak of employee personal data; actual damage under investigation on a server holding information on about 1,700 people
Unauthorised access to servers of Hanwha Systems' ICT division, using external access accounts of some affiliates, led to the leak of employees' names, contact details and company email addresses. The servers held information on about 1,700 people, and the actual scale of the damage is under investigation. Hanwha Systems reported the incident to the Korea Internet & Security Agency and said its defence and financial affiliates were not affected.
Related reports: 7 · last report →
Also affected: 1- Hanwha EnginePossible leak of 1,903 personal data records concerning Hanwha Engine employees and othersPossible leak of 1,903 personal data records concerning employees and partner company staff
PowerSchool hack leaks student and staff personal data
62mImpact: Leak of student and staff personal data; the attacker claimed to have stolen data on 62 million students
Education technology company PowerSchool was hacked, leaking personal data of students and staff at North American schools. The attacker claimed to have stolen data on 62 million students, and PowerSchool paid the hacker, but school districts were later hit with further extortion demands. A US university student involved in the case pleaded guilty and was later sentenced to federal prison.
Related reports: 105 · last report →
Also affected: 9- Walker County SchoolsWalker County Schools student information system data leaked
- Bozeman School DistrictBozeman School District pupils and teachers hit by PowerSchool data breachStudent and teacher data affected; scale unknown
- Union County Public SchoolsUnion County Public Schools hit by student information system breach
- Frederick County Public SchoolsFrederick County Public Schools affected by PowerSchool data breach
- Toronto District School BoardPowerSchool breach: 40 years of Toronto school board pupil data stolen40 years' worth of student data
- Centers for Medicare & Medicaid Services (CMS)CMS confirms impact from PowerSchool data breach
- Mercyhurst Preparatory SchoolPowerSchool cyber-attack may have exposed Mercyhurst school data
- Buford City SchoolsPowerSchool hack exposes Buford City Schools pupil and teacher dataStudent and teacher data
- Three international schools in SeoulPowerSchool hack exposes 15,666 personal data records at three Seoul international schools15,666 personal data records
Key incidents in other countries
Binance hack sees $6.3 billion in cryptoassets stolen
Impact: $6.3 billion in cryptoassets stolen
Around 29 October 2026, $6.3 billion in cryptoassets was stolen from Binance. A subsequent investigation revealed how North Korean attackers deceived an employee through a fake recruitment interview into installing malware and compromised wallet infrastructure. Binance resumed withdrawals and completed full reimbursement of affected customer assets, while the US government pursued freezing and seizure proceedings for some of the stolen assets.
Related reports: 303 · last report →Data on over 41,000 Homeland Security employees leaked
41kImpact: Information on more than 41,000 employees
Information on more than 41,000 US Department of Homeland Security employees was stolen and published online. The leaked material included information on Immigration and Customs Enforcement and Customs and Border Protection employees, as well as the identities of undercover agents. The Department of Homeland Security launched an investigation into the leak.
Related reports: 77 · last report →GMO forex service hack causes unauthorised trades and customer losses
Impact: Reported losses across 2,943 accounts totalling ¥2.99 billion; related costs, including compensation, of ¥3.05 billion
Unauthorised access to GMO's foreign exchange trading service led to a data leak and unauthorised trades. As at 13 November, users had reported losses totalling ¥2.99 billion across 2,943 accounts, while costs including compensation for customer losses and goodwill payments came to ¥3.05 billion. GMO carried out a group-wide review. It also emerged that vulnerabilities had been highlighted and a system redesign proposed two years earlier, but no action had been taken.
Related reports: 36 · last report →Taiwan's 91APP order database breach may expose data of 4.8 million consumers
4.8mImpact: Potential exposure of information on 4,798,255 consumers across up to 1,329 brands
A breach of Taiwanese e-commerce platform 91APP's order database raised concerns that 4,798,255 consumers across up to 1,329 brands could be affected. Names, telephone numbers, delivery addresses, email addresses and order histories were potentially exposed, but the actual extent of unauthorised access or theft has not been confirmed. 91APP allowed consumers to apply for compensation even without financial losses and moved the application channel from Google Forms to its official website. Taiwan's Ministry of Digital Affairs suggested a link to the AI hacking tool ARTEX.
Related reports: 27 · last report →Arara email service cyber-attack exposes 81.33 million email addresses
81.3mImpact: 81,329,467 email addresses and some customers' member information
Japan's Arara Message email delivery service was breached through a web server vulnerability, exposing email addresses and some customers' member information. Further investigation put the number of unique email addresses exposed at 81,329,467. The attacker also misused the service to send up to approximately 7.13 million emails impersonating credit card companies, and the company isolated the servers and suspended its email delivery service entirely.
Related reports: 20 · last report →