Week 5, 2025 security incident report
Hacking and data breach incidents newly reported 2025.01.27 ~ 02.02
New cybersecurity incidents recorded from January 27 to February 2, 2025, numbered 1 in South Korea and 40 overseas, and the key South Korean incident was the hacking of 24 sites, including 2 in South Korea, by a pro-Russian hacker group. By incident type overall, hacking/intrusion was the most common at 24, followed by 11 personal data breaches and 5 ransomware incidents. Cascading damage from Otelier to Marriott International, Inc. was also confirmed. Overseas, an exposed DeepSeek database leaked chat histories and personal data, while ransomware caused IT service outages, theft of customer information and disruptions to medical services at Tata Technologies, MGM Resorts and Frederick Health hospital.
By type
- Hacking & intrusion23
- Data breach10
- Ransomware5
- Malware1
Key incidents in South Korea
Pro-Russian hacker group hacks 24 sites, including 2 in South Korea
Impact: 24 websites hacked, including 2 in South Korea
A pro-Russian hacker group hacked 24 websites, including two in South Korea. The names of the affected organizations, the attack method and the specific response have not been confirmed.
Read on 보안뉴스 ↗
Supply-chain breaches
Otelier breach exposes data of about 500,000 hotel guests
500KImpact: Information and reservation details of about 500,000 hotel guests
Otelier was breached, exposing hotel guest information and reservation details. The scale was later reported as about 500,000 guests, and information related to Marriott and Hilton hotels was also among the data exposed.
Related reports: 5 · last report →
Also affected: 1Ransomware attack encrypts some files at US firm ENGlobal
Impact: Some files encrypted and IT access restricted
US energy and engineering company ENGlobal discovered a ransomware attack on November 25, and some files were encrypted. In responding, it limited IT access to essential operations. It was unable to give a timeline for full recovery.
Read on SecurityWeek ↗
Key incidents in other countries
Tata Technologies suspends IT services after ransomware attack
Impact: Damage to IT assets and suspension of IT services
Indian company Tata Technologies was hit by a ransomware attack that damaged its IT assets, and it suspended IT services. The company restored services and reported the incident to Indian stock exchanges. An investigation into the cause of the incident was launched.
Related reports: 12 · last report →DeepSeek database exposure leaks chat logs and other sensitive data
Impact: Leak of sensitive data including chat logs, and of users' personal information
Security firm Wiz discovered sensitive data, including chat logs, leaking from an exposed DeepSeek database. The South Korean government also moved to look into the personal data leak, and the Personal Information Protection Commission (PIPC) sent DeepSeek a formal inquiry. A leak of users' personal information was later confirmed.
Related reports: 10 · last report →Globe Life says data of about 850,000 more people may have been compromised
850KImpact: Possible additional compromise of personal information of about 850,000 people beyond the roughly 5,000 previously disclosed
US insurer Globe Life disclosed that, in addition to the roughly 5,000 people previously announced, the information of about 850,000 people may also have been compromised. The compromised information may include names, Social Security numbers, health information and insurance information. The company did not comply with the attackers' demand for money and is notifying about 850,000 people of the breach.
Related reports: 4 · last report →Ransomware disrupts medical services at Frederick Health Hospital
Impact: IT systems shut down and medical services disrupted
Frederick Health Hospital in Maryland, United States, experienced disruptions to medical services after being affected by a ransomware attack. The health network shut down its IT systems following the attack. On February 3, 2025, pregnant women were still facing inconvenience such as delayed care due to the incident.
Related reports: 3 · last report →Smiths Group isolates systems after unauthorized access
British engineering company Smiths Group disclosed unauthorized access to its systems on January 29, 2025. The company isolated the affected systems, activated its business continuity plans and began restoring systems. Whether data had been stolen was under investigation.
Related reports: 3 →