Week 26, 2024 security incident report
Hacking and data breach incidents newly reported 2024.06.24 ~ 06.30
From June 24 to 30, 2024, five new incidents were confirmed in South Korea, with the leak of the names, email addresses, hotel booking information and card information of 1,246 South Korean HotelsCombined users emerging as a major incident with a stated scale of damage. Data leak damage continued in the finance, automotive and travel industries, including the unauthorized leak of Yuanta Securities customers' personal data by an outsourcing contractor and Seoyon Autovision's report of a ransomware infection and data leak, and copyright-notice phishing impersonating entertainment agency staff was also confirmed. By type overall, hacking/intrusion was the most common at 20, followed by ransomware and personal data leaks at 12 each. Overseas, ransomware at Indonesia's national data center, which disrupted government and public services and immigration operations, stood out, and cascading damage from CDK Global to AutoNation and from the Los Angeles Unified School District to Neiman Marcus was also reported.
By type
- Hacking & intrusion20
- Data breach12
- Ransomware11
- Malware1
- Phishing & smishing1
Key incidents in South Korea
HotelsCombined leaks personal data of 1,246 South Korean users
1.2KImpact: Names, email addresses, hotel reservation details and card information of 1,246 South Korean users
A hacker who hijacked a HotelsCombined account through phishing exploited a flaw in its permissions design to view and leak the personal information of 1,246 South Korean users. The leaked information included names, email addresses, hotel reservation details and card information. The Personal Information Protection Commission (PIPC) imposed a penalty surcharge of 94.5 million won and a fine of 16 million won for violations of safety measure and breach notification and reporting obligations.
Related reports: 3 →Yuanta Securities customer data leaked without authorization by contractor
Impact: Customers' personal information
Personal information of Yuanta Securities customers was leaked without authorization through an outsourcing contractor. A related first-instance trial in June 2024 revealed gaps in personal information management, and in July the arrest of the contractor's CEO was reported.
Related reports: 2 · last report →Claim links NAVER Cloud hack to Japanese security products
A hack of NAVER Cloud triggered the LINE affair. Choi Min-hee claimed the hack was related to the use of Japanese security products.
Read on 뉴시스 ↗Seoyon Autovision reports ransomware infection and data leak
Impact: Data leak
The company affected by a ransomware infection previously reported as an incident at Seoyon E-Hwa was confirmed to be its affiliate Seoyon Autovision. On June 26, 2024, Seoyon Autovision reported a data leak resulting from the infection to the Personal Information Protection Commission (PIPC). Seoyon E-Hwa said the issue had been resolved.
Read on 이데일리 ↗Copyright notice phishing impersonates Woollim Entertainment staff
Phishing emails posing as copyright infringement notices from Woollim Entertainment staff have appeared. Woollim Entertainment urged caution regarding the emails.
Read on 보안뉴스 ↗
Supply-chain breaches
CDK Global ransomware causes widespread outages at North American car dealerships
Impact: Operations disrupted at more than 15,000 car dealerships in North America
In June 2024, CDK Global shut down its dealership management software after a cyberattack, disrupting more than 15,000 dealerships in North America. The outage was found to have been caused by a BlackSuit ransomware attack, and some dealerships processed work by hand. While the service outage continued, the attackers demanded millions of dollars, and affected dealerships filed lawsuits.
Related reports: 37 · last report →
Also affected: 1- AutoNation, Inc.AutoNation hit by CDK Global cyberattack and outageDamage from CDK Global service outage
Los Angeles Unified School District data stolen in Snowflake account hack
↳ Knock-on damage from the Snowflake incident · View original incidentImpact: Student and vendor data
The Los Angeles Unified School District confirmed the theft of data linked to the hacking of its Snowflake account. The stolen data included student data and vendor data.
Related reports: 2 · last report →
Also affected: 1
Key incidents in other countries
Ransomware on Indonesia's national data center paralyzes government services
Impact: National data center encrypted and government services paralyzed
Indonesia's national data center was hit by a ransomware attack that encrypted it and paralyzed government services. The attackers demanded an $8 million ransom, but the Indonesian government refused to pay. After the attack, the president ordered an audit of the data center.
Related reports: 11 · last report →Ransomware attack on Indonesia's national infrastructure disrupts services
Impact: Disruption to immigration services and national infrastructure operations
A ransomware attack in Indonesia disrupted immigration services and national infrastructure. It emerged that the backups required for recovery were missing, and the attackers apologized and released the decryption key for free. Indonesia then began recovering the data.
Related reports: 9 · last report →Former vendor employee accessed data of 1.2 million Geisinger patients without authorization
1.2MImpact: Possible exposure of information of 1.2 million patients
A former employee of Nuance, an outside IT service provider to US healthcare provider Geisinger, abused their access to view patient data without authorization. Information of 1.2 million patients may have been exposed. A $5 million settlement was pursued in the related lawsuit, and a court approved it in March 2026.
Related reports: 8 · last report →Kadokawa and Niconico hit by ransomware attack
Kadokawa and Niconico were hit by a ransomware attack in June 2024. The BlackSuit group claimed responsibility for the attack on Kadokawa, followed by threats to release the stolen information.
Related reports: 8 · last report →TeamViewer corporate network breach leaks employee directory and encrypted passwords
Impact: Employee directory data and encrypted passwords
TeamViewer's corporate IT network was breached using stolen employee credentials. The attackers copied employee directory data and encrypted passwords. TeamViewer officially attributed the attack to a Russian cyber-espionage group.
Related reports: 7 · last report →