Week 4, 2025 security incident report
Hacking and data breach incidents newly reported 2025.01.20 ~ 01.26
New cybersecurity incidents recorded from January 20 to 26, 2025, numbered 0 in South Korea and 58 overseas, with no major South Korean incidents reported. Across all types, 25 personal data breaches and 24 hacking/intrusion incidents accounted for the majority, while ransomware numbered 7. Cascading damage extending to two medical institutions linked to Exostar and three educational institutions linked to PowerSchool also stood out. The largest overseas incident was the cyberattack on Conduent, which leaked information on 44 million people, while new sign-up restrictions and service disruptions at DeepSeek caused by a large-scale cyberattack also emerged as a major incident.
By type
- Data breach26
- Hacking & intrusion23
- Ransomware6
- DDoS1
- Malware1
Supply-chain breaches
Exostar issues breach notice over third-party system
A data breach involving a third-party system occurred at Exostar. Exostar filed an official data breach notice regarding the incident. The specific scale of the breach and the date of the incident have not been confirmed.
Read on JD Supra ↗
Also affected: 2PowerSchool hack leaks student and staff personal data
62MImpact: Leak of student and staff personal data; the attacker claimed to have stolen data on 62 million students
Education technology company PowerSchool was hacked, leaking personal data of students and staff at North American schools. The attacker claimed to have stolen data on 62 million students, and PowerSchool paid the hacker, but school districts were later hit with further extortion demands. A US college student involved in the case pleaded guilty and was later sentenced to federal prison.
Related reports: 105 · last report →
Also affected: 9- Walker County SchoolsWalker County Schools student information system data leaked
- Bozeman School DistrictBozeman School District students and teachers hit by PowerSchool data breachStudent and teacher data affected; scale unknown
- Union County Public SchoolsUnion County Public Schools hit by student information system breach
- Frederick County Public SchoolsFrederick County Public Schools affected by PowerSchool data breach
- Toronto District School BoardPowerSchool breach: 40 years of Toronto school board student data stolen40 years' worth of student data
- Centers for Medicare & Medicaid Services (CMS)CMS confirms impact from PowerSchool data breach
- Mercyhurst Preparatory SchoolPowerSchool cyberattack may have exposed Mercyhurst school data
- Buford City SchoolsPowerSchool hack exposes Buford City Schools student and teacher dataStudent and teacher data
- Three international schools in SeoulPowerSchool hack exposes 15,666 personal data records at three Seoul international schools15,666 personal data records
Key incidents in other countries
Conduent Cyberattack Leaks Data of 44 Million People
44MImpact: Data of 44 million people leaked
An intrusion at Conduent that began in 2024 led to a cyberattack in January 2025, causing outages in government agency services and a leak of client data. The stolen files included personal data of clients' end users, and the scale of the damage later grew to 44 million people. Conduent confirmed the leak, carried out victim notifications and agreed to settle claims in related lawsuits.
Related reports: 41 · last report →DeepSeek limits new sign-ups after large-scale cyberattack
Impact: New registrations restricted and service disrupted
DeepSeek restricted new registrations after being hit by a large-scale cyberattack. The service disruption occurred as users flocked to the platform and its AI chatbot climbed to the top of app store rankings.
Related reports: 12 · last report →Actor Dean Norris's X account hacked to promote memecoin scam
Impact: Personal X account misused to promote a memecoin scam
Actor Dean Norris's X account was hacked and used to promote DEAN, a memecoin named after him. Norris said his account had been hacked.
Related reports: 9 · last report →HPE investigates breach after claims of stolen sensitive data and source code
IntelBroker claimed to have stolen sensitive data from HPE and offered the data for sale. The claim included source code, and HPE launched an investigation into a possible breach.
Related reports: 6 · last report →Tbilisi public transit payment terminals hacked to play pro-European messages
Impact: Pro-European messages and songs played on public transit payment terminals
Public transit payment terminals in Tbilisi, Georgia, were hacked to play pro-European messages and songs. Anonymous claimed that Georgian hackers affiliated with it carried out the attack.
Related reports: 5 · last report →