Week 5, 2024 security incident report

Signs of hacking found at about 100 South Korean universities, hospitals and other sites

Impact: Signs of hacking at about 100 South Korean websites; leak of transcripts, staff photos, internal approval documents and more

Signs of hacking were found on the websites of about 100 South Korean universities, hospitals and clinics, small and medium-sized businesses and local government-affiliated bodies, and student transcripts, staff photos and internal approval documents were leaked. Police investigated the possibility that Chinese hackers were responsible and that the damage spread through the compromise of shared hosting servers. A suspected hack of the personal information of 110,000 school staff and students in Incheon also came under investigation.

Tampered GetAmped spectator feature disrupts gameplay

Impact: Disrupted gameplay for players and about 11 hours of emergency maintenance

Tampering with GetAmped's spectator feature disrupted players' games. About 11 hours of emergency maintenance were carried out, and operator JUNINTER took steps to prevent use of the tampered spectator feature.

KB Kookmin Card impersonation phishing abuses device-linking feature

An attack was identified in which text messages impersonating KB Kookmin Card card-issuance and payment notices lured victims into contacting fake customer service centers and installing remote-control programs and malicious apps. By abusing stolen accounts and smartphones' feature for linking other devices, the attackers were able to maintain access even after the apps were deleted.

GetAmped undergoes emergency maintenance amid server hacking suspicions

Suspicions of a server hack were raised at the online action game GetAmped, and emergency maintenance was carried out. Whether a hack actually occurred and the extent of any damage have not been confirmed.

Identity verification hacking raises security concerns at South Korea's three mobile carriers

Identity verification breaches by hackers and security problems at South Korea's three major mobile carriers were raised. The specific method of intrusion, the extent of the damage, when it occurred and the response measures have not been confirmed.

Teenager who hacked online bookstores and cram school referred to juvenile court

Impact: Unauthorized acquisition of decryption keys for a total of more than 2.15 million e-books and distribution of about 700 lecture videos

A teenager who hacked online bookstores and a college-prep academy, stole e-book decryption keys and lecture videos, and demanded money was referred to the juvenile division of the family court. The teen was found to have obtained without authorization decryption keys corresponding to more than 720,000 e-books and more than 1.43 million e-books from another bookstore, and to have distributed about 700 lecture videos.

Cyberattack takes down network at Chicago's Lurie Children's Hospital

Impact: Systems and network outage and disruption to access to care

Lurie Children's Hospital in Chicago, United States, suffered a cyberattack and took its systems and network offline. As the network outage lasted for weeks, parents struggled to get care for their children. The hospital confirmed the attack was by a known criminal threat actor and, as of February 8, had not given a timeline for recovery.

Ransomware attack disrupts administrative and court operations in Fulton County, US

Impact: Disruption of online systems, court operations and other services

In January 2024, Fulton County, Georgia, in the United States, was hit by a cyberattack that disrupted its online systems and court operations, among other services. LockBit claimed the ransomware attack and threatened to release stolen documents, while the county worked to restore its systems. County leaders said an employee's mistaken click led to the attack, and the official in charge refused to pay a ransom of millions of dollars.

Schneider Electric's sustainability business hit by ransomware

Schneider Electric's sustainability business division was hit by a ransomware attack in January 2024. The company confirmed the attack on the division, which was linked to the Cactus ransomware.

Cloudflare internal system breach exposes source code

Impact: Access to source code and internal documents; internal wiki and bug database affected

Cloudflare's internal Atlassian systems were breached around Thanksgiving 2023. The attacker, believed to be state-sponsored, used credentials and authentication tokens stolen in the earlier Okta breach to access source code and internal documents, and the internal wiki and bug database were also affected. In its response, the company rotated about 5,000 production credentials.

AnyDesk resets passwords after production server breach

Hackers breached the production servers of remote desktop software company AnyDesk. AnyDesk carried out a broad reset of passwords and credentials and said the software was safe to use afterward. The specific extent of the customer data compromise has not been confirmed.