Week 51, 2024 security incident report
Hacking and data breach incidents newly reported 2024.12.16 ~ 12.22
From December 16 to 22, the incident that drew the most attention in South Korea, with 13 articles, was the hacking of Stibee's servers, which leaked members' personal data and some members' credit information. At Simmtech, ransomware encrypted some production systems and data, and the attack group claimed to have stolen about 745 GB of internal data, while at an agency under the Ministry of Education, the phone numbers of 957 teachers researching AI textbooks were leaked. Across all types, 22 personal data breaches and 19 hacking/intrusion incidents stood out, and in South Korea, too, data leaks and damage to production systems occurred together. Overseas, the leak of data on about 1.46 million patients at Texas Tech University Health Sciences Center and administrative disruptions from an attack on Ukraine's state registry systems occurred, and cascading damage from Blue Yonder to Starbucks, Morrisons and Waterstones was also confirmed.
By type
- Data breach23
- Hacking & intrusion18
- Ransomware8
- Malware2
- Phishing & smishing1
Key incidents in South Korea
Stibee server hack leaks members' personal and credit information
Impact: Members' names, email addresses and encrypted passwords, and some members' credit information
On December 17, 2024, the servers of newsletter platform Stibee were hacked, leaking members' names, email addresses and encrypted passwords, as well as some members' credit information. The incident also led to spam emails impersonating South Korea's Ministry of Foreign Affairs. Stibee announced follow-up measures including blocking the illegal access route, introducing two-factor authentication and destroying temporarily retained credit information, and the Personal Information Protection Commission (PIPC) launched an investigation.
Related reports: 13 · last report →Simmtech ransomware attack encrypts some production systems and data
Impact: Some production systems and data encrypted; attackers claim to have stolen about 745GB of internal data
Simmtech said that some of its production systems and data were encrypted in a ransomware attack on November 9, 2024, and that it recovered within two to three days. In December, the ransomware group Underground claimed to have stolen about 745GB of internal data and released items including the chairman's passport photo and tax-related documents.
Related reports: 3 · last report →Phone numbers of 957 AI textbook research teachers leaked from agency under South Korea's Education Ministry
957Impact: Phone numbers of 957 AI textbook research teachers
The phone numbers of 957 teachers involved in AI textbook research were leaked from an agency under South Korea's Ministry of Education. The name of the agency, the cause of the leak, the date of the incident and the response have not been confirmed.
Read on 경향신문 ↗10 years after the KHNP hack, North Korean cyberattacks continue
The Korea Hydro & Nuclear Power hacking incident marked its 10th anniversary in 2024. North Korean cyberattacks are continuing, and the specific scale of damage and response to the incident have not been confirmed.
Read on 보안뉴스 ↗
Supply-chain breaches
Blue Yonder ransomware attack disrupts retailers' logistics and workforce management
Impact: Operational disruptions including Starbucks workforce management and UK retailers' logistics and warehouse systems
Blue Yonder discovered a ransomware attack on November 21, 2024, causing cascading disruptions to customer operations. Retailers' operations were affected, including employee hours and schedule management at Starbucks and fresh food warehouse management at Morrisons. When the ransomware group Termite claimed the attack and the theft of 680GB of data, Blue Yonder investigated the claims.
Related reports: 14 · last report →
Also affected: 2- MorrisonsBlue Yonder cyberattack hits Morrisons supply chainSupply chain operations affected
- Waterstones Booksellers LimitedBlue Yonder ransomware attack hits Waterstones warehouse systemsWarehouse system operations affected
Key incidents in other countries
Texas Tech Health Sciences Center breach exposes data of about 1.46 million patients
1.5MImpact: Personal information and medical records of about 1.46 million patients; $2 million in costs and a separate revenue loss
Texas Tech University Health Sciences Center was hit by a ransomware attack that leaked patients' personal information and medical records. In December 2024, the number of people affected was reported as about 1.46 million. In February 2025, it was disclosed that incident response costs had reached $2 million and that the center had also suffered a separate revenue loss.
Related reports: 9 · last report →Meta's 2018 security breach leaked data from 29 million Facebook accounts
Impact: Information from 29 million Facebook accounts leaked
A 2018 security breach at Meta leaked information from 29 million Facebook accounts. The victims included about 3 million users in the European Union. In December 2024, Meta was fined 251 million euros in connection with the incident.
Related reports: 9 · last report →Cyberattack on Ukraine's state registers disrupts administration
Impact: Disruption of vehicle ownership transfers, marriage registrations and real estate transactions
Ukraine's state registers were hit by a massive cyberattack, disrupting vehicle ownership transfers, marriage registrations and real estate transactions. Ukrainian authorities named Russia as the perpetrator. The state registers were later restored.
Related reports: 7 · last report →Unauthorized access to Pembina Trails School Division student data database
Impact: Unauthorized access to a database containing students' personal information
Pembina Trails School Division said a cyberattack had resulted in unauthorized access to a database containing students' personal information. The number of affected students, the specific types of information and the response have not been confirmed.
Related reports: 6 · last report →Wood County in the US pays $1.5 million over ransomware attack
Impact: $1.5 million paid in ransomware response
Wood County, Ohio, was hit by a ransomware attack in December 2024. The county paid $1.5 million to resolve the attack. Subsequently, in January 2025, the county's IT director resigned.
Related reports: 4 · last report →