Week 47, 2024 security incident report

342,000 ether stolen in Upbit hack

Impact: 342,000 ether, worth about 58 billion won at the time

In 2019, 342,000 ether, worth about 58 billion won at the time, were stolen from Upbit. In November 2024, police announced the results of their investigation, concluding that the North Korean hacking groups Lazarus and Andariel were responsible. Some of the assets were recovered through cooperation with Switzerland.

North Korea confirmed behind theft of 58 billion won in virtual assets

Impact: 58 billion won in virtual assets

A theft of virtual assets worth 58 billion won occurred. Police concluded that North Korea was behind the incident, marking the first confirmed case of damage in South Korea from North Korean theft of virtual assets.

Administrator Account Credentials of University Hospitals, City Halls and Other Public Institutions Hacked

Impact: Administrator account credentials of public institutions including university hospitals and city halls

Administrator account credentials of public institutions, including university hospitals and city halls, were hacked. The names of the affected institutions, the extent of the damage, the intrusion route and the response have not been confirmed.

Ransomware Group RA Group Claims Theft of 700GB of SK Gas Data

Impact: Claimed theft of 700GB including employees' personal information and departmental data

Ransomware group RA Group claimed to have stolen 700GB of SK Gas data, including employees' personal information and departmental data. Whether the data was actually stolen, the date of the incident and SK Gas's response have not been confirmed.

Smilegate Leaks Personal Data During Lost Ark Art Book Sale

Personal information was leaked during Smilegate's sale of a Lost Ark art book. The scale of the leak, its specific cause, when it occurred and the response measures have not been confirmed.

I Am Solo Season 22 cast member Ok-soon hacked, vows to respond

Ok-soon, a cast member of season 22 of I Am Solo, was hacked. Ok-soon said she would not stay silent and expressed her intention to respond.

Bankbook copies left on community center copier

Copies of bankbooks were left unattended on a multifunction copier at an administrative welfare center, revealing a risk of personal information exposure. The specific institution, the actual scale of any leak and the response measures have not been confirmed.

Hacked home and classroom webcams used to livestream footage

Impact: Livestreaming of footage from home and classroom webcams

Webcams in homes and classrooms were hacked and used to livestream footage. The specific scale of the damage, the time of occurrence and the response have not been confirmed.

Blue Yonder ransomware attack disrupts retailers' logistics and workforce management

Impact: Operational disruptions including Starbucks workforce management and UK retailers' logistics and warehouse systems

Blue Yonder discovered a ransomware attack on November 21, 2024, causing cascading disruptions to customer operations. Retailers' operations were affected, including employee hours and schedule management at Starbucks and fresh food warehouse management at Morrisons. When the ransomware group Termite claimed the attack and the theft of 680GB of data, Blue Yonder investigated the claims.

Finastra file transfer system breach exposes personal data

800KImpact: Personal information and Social Security numbers of more than 800,000 Americans exposed

Finastra's internal SFTP system was breached in an attack using stolen credentials, leading to a leak of personal information. The company detected suspicious activity on November 7, 2024, and isolated the platform, while the attacker claimed to be selling 400GB of data. The company began notifying victims in February 2025, and in July it was reported that more than 800,000 Americans were affected.

Stop & Shop cyberattack disrupts product supply ahead of Thanksgiving

Impact: Product supply disruption and empty shelves at some stores

Affected by a cyberattack, Stop & Shop suffered product supply disruptions in November 2024 ahead of Thanksgiving, including empty shelves at some stores. The disruption continued until November 22, and a return to normal operations was expected on the same day.

Hannaford Restores Online Services Disrupted by Cyberattack

Impact: Online service outage

Hannaford was hit by a cyberattack that disrupted its online services. On November 19, 2024, it was reported that online services were working normally again.

Gandara Mental Health Center data breach affects more than 20,000 clients

20KImpact: More than 20,000 clients

A data breach at Gandara Mental Health Center affected more than 20,000 clients. The center later settled a class action lawsuit over the incident.