Week 13, 2025 security incident report
Hacking and data breach incidents newly reported 2025.03.24 ~ 03.30
New cybersecurity incidents recorded from March 24 to 30, 2025, numbered 1 in South Korea and 58 overseas, and in South Korea, the Personal Information Protection Commission's imposition of fines on three companies over personal data leaks was the main story. By type overall, personal data breaches were the most common at 31, followed by 18 hacking/intrusion incidents and 7 ransomware incidents, and cascading damage from WideOpenWest to StreamElements was also confirmed. Overseas, in the Oracle legacy server hack, which received the most coverage with 23 articles, the attacker claimed to have leaked credentials affecting 6 million users, while the leak of patient data on about 20 million people at Oracle Health, allegations of a leak of personal data on about 200 million X users, and ransomware damage in the airport and healthcare sectors stood out.
By type
- Data breach31
- Hacking & intrusion16
- Ransomware7
- DDoS2
- Phishing & smishing1
Key incidents in South Korea
PIPC fines three companies over personal data leaks
The Personal Information Protection Commission (PIPC) imposed fines totaling more than 16 billion won on three companies over personal data leaks. The names of the companies, the scale of each leak and the dates of the incidents have not been confirmed.
Read on 테크월드 ↗
Supply-chain breaches
Arkana ransomware gang claims attack on WideOpenWest
The Arkana ransomware gang claimed to have attacked US telecom company WideOpenWest. Data obtained through infostealer infections was cited as having been used in the attack.
Related reports: 3 · last report →
Also affected: 1
Key incidents in other countries
Oracle legacy server hack leaks customer credentials
Impact: Credentials for 6 million users, according to the attacker
Allegations emerged that Oracle Cloud customer credentials had been stolen, and several customers confirmed that samples provided by the attacker matched their own data. The attacker claimed to have stolen data on 6 million users. Oracle later acknowledged a breach of legacy servers but denied that its flagship cloud platform, OCI, had been compromised.
Related reports: 23 · last report →Oracle Health hack leaks patient data of about 20 million people
20MImpact: Patient data of about 20 million people
Oracle Health was hacked in 2025, leaking patient data. The US Federal Bureau of Investigation investigated the attack, and leaks affecting healthcare providers were later disclosed. The scale confirmed in October 2026 is about 20 million people.
Related reports: 12 · last report →Malaysian airport operator hit by ransomware, $10 million demanded
Impact: The operator's and sources' accounts differ on whether airport operations were disrupted
Malaysian airport operator MAHB was hit by a cyberattack, and the attackers demanded a $10 million ransom. Prime Minister Anwar refused to pay the ransom. MAHB denied any disruption to Kuala Lumpur International Airport operations, but sources claimed there was disruption lasting about 10 hours.
Related reports: 12 · last report →Alleged leak of personal data of 200 million X users
200MImpact: Alleged leak of personal information of about 200 million users
Allegations emerged of a leak of personal information affecting more than 200 million X users. Hackers were also claimed to have distributed 2.9 billion records related to Twitter/X users, while it was also explained that the data was public information. Later, a leak of about 200 million social media records was also reported.
Related reports: 11 · last report →Cyberattack on Ukrainian Railways disrupts ticket sales
Impact: Disruption to train ticket sales
Ukraine's railway system was hit by a targeted cyberattack that disrupted train ticket sales. Ukraine saw the attack as a Russian attempt to cause chaos. The specific attack method and the status of recovery have not been confirmed.
Related reports: 9 · last report →