Week 4, 2024 security incident report
Hacking and data breach incidents newly reported 2024.01.22 ~ 01.28
From January 22 to 28, 2024, seven incidents were recorded in South Korea, with the leak of personal data of about 236,000 Worknet members at the Korea Employment Information Service standing out the most by number of people affected. Personal data incidents continued in the public sector and finance, including the leak of about 11,000 member records at the National Aviation Museum of Korea, the Korea Exchange's acknowledgment of a personal data leak, and an alleged leak of Korea Post member data. The distribution of malicious apps through smishing impersonating Kakao services and controversy over a crypto hack worth around 100 billion won and insider responsibility also emerged, and across all types in South Korea and abroad, personal data leaks were the most common at 30. Overseas, the discovery of a repository of about 26 billion leaked records and follow-up measures after the Medibank breach drew attention, and ransomware damage in the water sector and to an emergency dispatch system was also confirmed.
By type
- Data breach30
- Hacking & intrusion10
- Ransomware9
- Phishing & smishing1
Key incidents in South Korea
Personal data of about 236,000 Worknet members leaked at Korea Employment Information Service
236KImpact: Personal information of about 236,000 Worknet members
The personal information of about 236,000 people was leaked from Worknet, operated by the Korea Employment Information Service. An investigation by the Personal Information Protection Commission (PIPC) found inadequate defenses against credential stuffing. On January 25, 2024, the PIPC imposed a fine of 8.4 million won on the Korea Employment Information Service and issued a recommendation for improvement.
Related reports: 4 →About 11,000 member records leaked from National Aviation Museum of Korea's online learning platform
11KImpact: About 11,000 member records
About 11,000 member records, including users' names, dates of birth, addresses and contact details, were leaked from the National Aviation Museum of Korea's online aviation learning platform. Obituary-themed smishing messages impersonating the museum were also sent, raising concerns about further harm to members. Shared administrator accounts and poor access controls later came to light, and a fine of 98 million won was imposed over the personal data leak.
Related reports: 4 · last report →Alleged leak and sale of Korea Post members' personal data
Allegations were raised that the personal information of Korea Post members had been leaked. A hacker claimed to have already sold the data, but Korea Post said there were no signs of a leak.
Read on 보안뉴스 ↗No charges in personal data leak case for which public corporation branch head apologized
The head of a branch of a public corporation apologized for a personal data leak. Police concluded there were no grounds for charges in the case. The corporation's official name, the scale of the damage and the reasons for the decision were not disclosed.
Read on OhmyNews ↗Smishing impersonating Kakao services spreads malicious app
Smishing messages impersonating Kakao services spread, using keywords such as 'Kakao Pick' and 'safe remittance' to lure recipients into claiming small money transfers. The Android malicious app installed through the link was found to collect device information and digital certificate information and send it to the attackers' server.
Read on 보안뉴스 ↗Early-year crypto hack worth 100 billion won sparks insider responsibility debate
Impact: Crypto assets worth in the 100 billion won range
A hack involving crypto assets worth in the 100 billion won range occurred early in the year. Insider responsibility was raised in connection with the incident, but the affected organization and the specific attack method have not been confirmed.
Read on 보안뉴스 ↗Korea Exchange admits personal data leak without disclosing details
Korea Exchange acknowledged a personal data leak. Details such as the scale of the leak, the data items involved and the timing have not been confirmed.
Read on 보안뉴스 ↗
Supply-chain breaches
Repository of 26 billion leaked records from multiple services discovered
26BImpact: About 26 billion leaked records
In January 2024, a data repository containing about 26 billion leaked records linked to multiple services including LinkedIn, Dropbox and X was discovered. It reportedly also included more than 60 million records linked to more than 16,000 South Korean sites and 164 million records linked to Vietnam. The possibility was later raised that the repository contained new breach data.
Related reports: 18 · last report →
Key incidents in other countries
Sanctions imposed and security upgrades pursued after Medibank data breach
Australia's Medibank suffered a personal data breach in a 2022 cyberattack. The regulator alleged that stolen credentials and a lack of multi-factor authentication enabled the intrusion and that the response was also delayed. Australia and other countries imposed sanctions on a Russian hacker involved, and Medibank decided to invest A$126 million in security improvements after the incident.
Related reports: 20 · last report →Repository of 26 billion leaked records from multiple services discovered
26BImpact: About 26 billion leaked records
In January 2024, a data repository containing about 26 billion leaked records linked to multiple services including LinkedIn, Dropbox and X was discovered. It reportedly also included more than 60 million records linked to more than 16,000 South Korean sites and 164 million records linked to Vietnam. The possibility was later raised that the repository contained new breach data.
Related reports: 18 · last report →Personal data of 533 million Facebook users leaked online
533MImpact: Personal data of 533 million Facebook users
In 2021, personal data of 533 million Facebook users was leaked online. In November 2024, a German court ruled that users affected by the leak could receive compensation.
Related reports: 7 · last report →Veolia North America water division hit by ransomware
Impact: Leak of personally identifiable information
Veolia North America's water division was hit by a ransomware attack. A leak of personally identifiable information in connection with the attack also came to light; the specific extent of the damage and the response measures have not been confirmed.
Related reports: 5 · last report →Bucks County ransomware attack takes down emergency dispatch system
Impact: Emergency dispatch system down for several days
The emergency dispatch system of Bucks County, Pennsylvania, was down for several days due to a cyberattack. 911 calls continued to be received, and authorities later determined that Akira ransomware was used in the attack.
Related reports: 5 · last report →