Week 46, 2024 security incident report

Korean Air accused of leaking cabin crew's illnesses, divorce status and other personal data

Impact: Personal information of cabin crew, including personal illnesses and divorce status

Allegations surfaced that personal information of Korean Air cabin crew, including personal illnesses and divorce status, had been leaked. There were also allegations that when crew members took leave, their personal information was shared regardless of their wishes.

Kyungsung University Fined After Portal Hack Leaks Personal Data

Impact: Leak of students' personal information

Kyungsung Portal, Kyungsung University's integrated information system, was hacked through a WebLogic vulnerability, leading to a leak of personal information. The Personal Information Protection Commission (PIPC) fined Kyungsung University KRW 42.8 million for leaving the vulnerability unaddressed for a long period and recommended that it overhaul its protection measures. The fines imposed on Soonchunhyang University and Kyungsung University total KRW 235.8 million.

Seoul Metro Hit by 140 Million DDoS Attacks in Two Days

140MImpact: 140 million DDoS attacks in two days

Seoul Metro was hit by 140 million DDoS attacks over two days. Hacking attacks over five years reached 1,200,006,588, 90% of which originated overseas.

Hacking Group Steals Law Firm's Litigation Files and Demands Money

Impact: Theft of litigation files

A hacking group targeted a law firm, stole litigation files and used them to demand money. The name of the affected law firm, the extent of the damage, the date of the incident and the response were not specified.

Ruling Says Fees Must Be Paid Under Advisory Contract to Resolve Hacking Incident

A ruling was reported finding that an advisory contract to resolve a hacking incident was a valid fee agreement and that the fees must therefore be paid. The organization affected by the hacking, the date of the incident, the extent of the damage and the specific incident response have not been confirmed.

Soonchunhyang and Kyungsung Universities Fined Over Personal Data Leaks

Personal information was leaked at Soonchunhyang University and Kyungsung University after hackers exploited WebLogic vulnerabilities in their main websites. The Personal Information Protection Commission (PIPC) imposed fines of KRW 193 million and administrative fines of KRW 6.6 million. After it was confirmed that the vulnerabilities had gone unfixed for more than six years, the universities were ordered to take measures including applying security patches and blocking access.

Compensation and Improvement Plans Announced for Lost Ark Art Book Data Leak

A personal data leak occurred in connection with the Lost Ark art book. Compensation and improvement plans were announced, while the specific scale of the damage, the cause of the leak and the date of the incident have not been confirmed.

Loopholes Flagged in Security Rules Revised After Hacking of Wall Pads in 700 Apartment Complexes

Impact: Hacking of wall pads in 700 apartment complexes

Critics said loopholes remain in security rules that were revised after the hacking of wall pads in 700 apartment complexes. The date of the hacking, the specific damage and any further response have not been confirmed.

Amazon employee data exposed in vendor's MOVEit breach

Impact: Employee data

Amazon employee data was exposed in a MOVEit breach linked to a hack of a third-party vendor. Amazon confirmed the employee data breach in November 2024.

Ahold Delhaize US business breach exposes data of 2.2 million people

2.2MImpact: Data of 2.2 million people leaked; disruption of online ordering and some pharmacy services

In November 2024, a breach of Ahold Delhaize's US business systems disrupted online ordering and some pharmacy services at Hannaford, Stop & Shop and other brands. The company took some systems offline and launched an investigation with external experts and law enforcement. It later confirmed that files had been stolen, and in June 2025 the number of people affected was reported to be 2.2 million.

Food Lion cyberattack causes payment outages and personal data leak

2.2MImpact: Personal information of 2.2 million people in total, including Food Lion employees and families, leaked, and payment systems disrupted

Food Lion was hit by a cyberattack in November 2024 that disrupted payment systems across the United States. The parent company issued a statement on the incident. It was later reported that the personal information of 2.2 million people in total, including Food Lion employees and their families, had been leaked.

T-Mobile confirms it was hit in China-linked hack of US telecom networks

T-Mobile was hacked in a China-linked cyber-espionage campaign targeting US telecommunications networks. It confirmed the hack in November 2024 and later released additional information about the attack.

Law Firm Breach Exposes Data of 300,000 Patients at US Healthcare Provider

305.1KImpact: Social Security numbers, medical records, prescription and insurance information of 305,088 patients

A breach at law firm Thompson Coburn exposed the information of 305,088 patients of its client Presbyterian Healthcare Services. The stolen or accessed files included Social Security numbers, medical records, prescription and insurance information. Thompson Coburn and the healthcare provider were sued over the data breach.