Week 3, 2024 security incident report
Hacking and data breach incidents newly reported 2024.01.15 ~ 01.21
From January 15 to 21, 2024, eight new cybersecurity incidents were recorded in South Korea, with the leak of personal data of about 1.35 million people at the Korea National Council on Social Welfare the largest by number of people affected. Personal data leaks stood out in the welfare, volunteering and education sectors, including the leak of data on 270,000 people from the volunteer certification system and 95,170 member records at Daesung Mimac. DDoS attacks and suspected attacks targeting internet broadcasting followed one after another, and phishing impersonating companies and website defacement also occurred. Overseas, 27 incidents were recorded, with the theft of Microsoft executives' emails and source code, among other data, and the leak of information on 35.5 million VF Corporation consumers emerging as the major incidents, and cascading damage from Kyivstar to VEON Ltd. was also confirmed.
By type
- Data breach13
- Hacking & intrusion11
- Ransomware6
- DDoS2
- Phishing & smishing1
Key incidents in South Korea
External hack of Daesung Mimac leaks 95,170 member records
95.2KImpact: 95,170 member records
Daesung Mimac became aware on January 16, 2024, of a leak of member information caused by an external hack. The leak involved 95,170 records, and the leaked items were user IDs, names, email addresses and mobile phone numbers. The company corrected the scale of the damage and said all items except user IDs had been masked.
Related reports: 6 · last report →Korea National Council on Social Welfare hack leaks data of about 1.35 million people
1.4MImpact: Personal information of about 1.35 million people
The Korea National Council on Social Welfare was hacked from outside, with signs found of a suspected leak of personal information of about 1.35 million people. The system resumed after eight days, and a fine of about 480 million won was later imposed over the leak of member information.
Related reports: 4 · last report →Hack of volunteer certification system leaks personal data
270KImpact: Confirmed leak of personal information of 270,000 people
A volunteer certification system was hacked, leaking personal information. Initially, the data of 1.35 million people was suspected to have been leaked, and a leak of the personal information of 270,000 people was later confirmed.
Related reports: 2 · last report →Suspected leak of Korea Communications Standards Commission complainants' personal information
Allegations were raised that the personal information of complainants to the Korea Communications Standards Commission had been leaked. Police raided the Korea Communications Standards Commission in January 2024 and raided a related portal in October.
Related reports: 2 · last report →Spate of DDoS attacks and suspected attacks on internet broadcasts
Impact: Damage to internet broadcasts including Janatdae and Macao Talk
Internet broadcast content including Janatdae and Macao Talk was hit by DDoS attacks. Suspected DDoS attacks also continued for two days on YouTube, AfreecaTV and other platforms.
Related reports: 2 · last report →CJ ENM warns of phishing scams impersonating the company
Phishing scams impersonating CJ ENM have occurred. CJ ENM urged caution against phishing scams impersonating the company.
Read on CJ 뉴스룸 ↗Ulsan HD FC website data listed for sale on dark web
A listing offering Ulsan HD FC website data for sale was posted on the dark web. Whether the website was actually hacked has not been confirmed.
Read on 보안뉴스 ↗Chinese hacker defaces Gimcheon Green Future Science Museum website
Impact: Website defaced
Chinese hacker Nian, formerly active in Xiaoqiying, defaced the website of the Gimcheon Green Future Science Museum and left the address of a Telegram channel he runs. Nian also threatened to hack South Korean government agencies. There was also an attempted DDoS attack against S2W, but S2W said it suffered no damage.
Read on 보안뉴스 ↗
Supply-chain breaches
Cyberattack on Ukraine's Kyivstar knocks out telecom services
Impact: Telecom services disrupted, part of infrastructure damaged, revenue losses estimated at about $100 million
On December 12, 2023, Kyivstar, Ukraine's largest mobile operator, was hit by a cyberattack that disrupted telecom services and damaged part of its infrastructure. Parent company VEON announced on December 19 that services had been restored. Revenue losses from the attack were later estimated at about $100 million, and Ukraine began gathering evidence to prosecute the attackers.
Related reports: 11 · last report →
Also affected: 1- VEON Ltd.Kyivstar cyberattack expected to cost parent VEON about $100 million in revenueExpected revenue loss of about $100 million
Key incidents in other countries
Microsoft executive emails and source code stolen
Impact: Theft of senior executives' emails, source code and some customer secrets
Microsoft had senior executives' email compromised in an attack by a hacker group linked to Russian intelligence. The group was identified as Midnight Blizzard. Microsoft later confirmed that source code and some customer secrets had also been stolen.
Related reports: 12 · last report →Ransomware disrupts Kansas City Area Transportation Authority communications
Impact: Communication systems including call center and landline phones knocked out
The Kansas City Area Transportation Authority in the US was hit by a cyberattack on January 23, 2024, knocking out communication systems including its call center and landline phones. Medusa claimed responsibility for the ransomware attack and demanded $2 million. Bus and paratransit services continued to operate.
Related reports: 4 · last report →71 million emails found in Naz.API stolen account list
Impact: 71 million email addresses and account credentials
71 million email addresses were found in the Naz.API stolen account list and added to the breach lookup service Have I Been Pwned. The leaked credentials included Facebook, eBay and Yahoo account information.
Related reports: 3 · last report →LockBit claims ransomware attack on sandwich chain Subway
Ransomware group LockBit claimed to have attacked sandwich chain Subway. The specific extent of the damage and any confirmation or response from Subway have not been confirmed.
Related reports: 3 · last report →Graphic videos and images posted to UC Irvine student Discord group
Impact: Graphic videos and images posted to a Discord group used by students
Hackers posted graphic videos and images to a Discord group used by University of California, Irvine students. Students and alumni responded, but the specific response and the extent of the damage have not been confirmed.
Related reports: 2 · last report →