Week 8, 2024 security incident report

Seraggio GC customer data leaked in partner company hack

Impact: Customer personal information leaked

Customer personal information was leaked from Seraggio GC, a golf course operated under contract by Kakao VX. Signs of the leak came to light on February 23, and a hack of a partner company was identified as the cause.

Tampered security program at construction association spreads malware

3KImpact: More than 3,000 installations of the malicious installer

On the website of a South Korean construction-related association, the installer for a security program required to log in was tampered with, distributing an infostealer and a backdoor. More than 3,000 installations of the malicious installer were counted, and a valid certificate belonging to a South Korean defense contractor was stolen and misused. The date of the incident and the response have not been confirmed.

Hwang Ui-jo's sister-in-law, who claimed hacking, submits apology letter citing betrayal

Hwang Ui-jo's sister-in-law, who had claimed a hacking, submitted a letter of apology saying she felt betrayed amid friction with his brother. Whether a hacking actually occurred, the specific intrusion method and the extent of damage have not been confirmed.

Change Healthcare ransomware attack leaks data of 190 million people

190MImpact: Personal data of 190 million people; prescription services disrupted across the US

In February 2024, Change Healthcare was hit by a ransomware attack that disrupted prescription-related services across the US and leaked personal information. The company worked to restore services and began notifying victims. The scale of the data breach later confirmed reached 190 million people, and the financial impact on healthcare providers continued.

Ransomware at US medical claims processor disrupts prescriptions and payments

Impact: Delayed prescription processing at pharmacies nationwide and US military pharmacies; $2 billion per week in disrupted hospital cash flow

A ransomware attack on a US medical claims processor delayed prescription processing at pharmacies across the US and at US military pharmacies worldwide. Medical billing and payments were also disrupted, leaving hospitals and doctors facing cash-flow strain and payroll problems. Some hospitals set up workarounds, and New York State announced new procedures to ensure continuity of healthcare services.

Leaked hacking files from Chinese tech firm expose surveillance at home and abroad

Impact: Large-scale leak of files related to hacking and cyber espionage

A large trove of hacking-related files from a Chinese tech company was leaked, exposing surveillance targeting both Chinese citizens and foreigners. The leaked files included material on hacking aimed at foreign governments, NATO and activists, as well as the tracking of ethnic minorities.

U-Haul exposes data of about 67,000 US and Canadian customers

67KImpact: Names, dates of birth and driver's license numbers of about 67,000 US and Canadian customers

An attacker used compromised credentials to access U-Haul's internal system for looking up reservations and customers, viewing the information of about 67,000 customers in the US and Canada. The exposed information included names, dates of birth and driver's license numbers, but not payment card information. U-Haul notified customers of the privacy breach.

Schneider Electric hit by ransomware as Cactus claims data theft

Impact: Claimed theft of 1.5TB of data; some files released, including images of passports and non-disclosure agreements

Schneider Electric was hit by a ransomware attack in January 2024. Cactus claimed it had stolen 1.5TB of data in the breach and released images of passports and non-disclosure agreement documents, among other files. The company subsequently worked to recover from the ransomware damage.