Week 18, 2025 security incident report
Hacking and data breach incidents newly reported 2025.04.28 ~ 05.04
From April 28 to May 4, 2025, six new incidents were recorded in South Korea, with the hacking of the Rural Development Administration's website, which leaked about 479,000 personal data records, causing the largest damage based on the stated number of leaked records. At Albamon, abnormal access leaked 22,473 temporarily saved résumés, the most-covered South Korean incident, while damage in insurance-related businesses also stood out, including harm to insurance agencies from the hacking of Genexon's IT solution and the leak of information on 1,107 people at Hana Financial Find and U-First. Across all types, personal data breaches numbered 41, more than the 13 hacking/intrusion incidents, 12 ransomware incidents and 1 DDoS attack, making data leaks the dominant pattern. Overseas, among 61 new incidents, the theft of information on 6.5 million members of the UK's Co-op and ransomware damage at Nova Scotia Power stood out, and cascading damage from MTN Group to MTN Ghana was also confirmed.
By type
- Data breach37
- Ransomware13
- Hacking & intrusion10
- DDoS1
Key incidents in South Korea
Abnormal access to Albamon leaks 22,473 résumés
22.5KImpact: Personal information in 22,473 temporarily saved résumés
On April 30, 2025, abnormal access to Albamon's résumé preview feature led to the leak of 22,473 temporarily saved résumés. The leaked information included names, mobile phone numbers and email addresses. The company blocked the attacking accounts and IPs and reported the incident to the relevant authorities, and later proposed compensating victims with 100,000 won.
Related reports: 26 · last report →Rural Development Administration website hack leaks about 479,000 personal records
479KImpact: About 479,000 personal records
The Rural Development Administration's website was hacked, and about 479,000 personal records, including member information, were estimated to have been leaked. The RDA apologized, completed breach reporting and notification, and operated an incident response task force and a call center for the public. It later also activated a cyber incident response team.
Related reports: 7 · last report →Genexon IT solution hack hits insurance agencies
An incident occurred at corporate insurance agencies due to the hacking of a Genexon IT solution. Concerns that the damage could spread arose after additional corporate insurance agencies were reported to have been posted on the dark web.
Related reports: 3 · last report →Hack of Hana Financial Find and UFirst leaks data of 1,107 people
1.1KImpact: Personal information of 1,107 people
The GA platform of Hana Financial Find and UFirst was hit by a hacking attack, leaking the information of 1,107 people. The attacker logged in to the platform with an administrator account.
Related reports: 2 · last report →Hyundai Motor Group employee personal data leaked
Impact: Employees' personal data
A leak of employees' personal data occurred at Hyundai Motor Group. The group notified employees of the incident by text message and email, and said customer data was safe.
Related reports: 2 →Samsung Electronics re-allows ChatGPT after 2023 leak of confidential data
Impact: Confidential information leaked, scale unknown
A leak of confidential information occurred at Samsung Electronics in 2023. Employees were later allowed to use ChatGPT again.
Read on SamMobile ↗
Supply-chain breaches
MTN Group cyberattack leaks customer data
5.7KImpact: Information of 5,700 customers in Ghana
African telecom company MTN Group disclosed in April 2025 that customer information had been leaked in a cyberattack. MTN said its core infrastructure was secure, and 5,700 customers in Ghana were confirmed to have been affected. The attack was also accompanied by demands.
Related reports: 9 · last report →
Also affected: 1- MTN Ghana (Scancom PLC)MTN Ghana data breach affects 5,700 customersData of 5,700 customers
Key incidents in other countries
UK Co-op hack exposes data of 6.5 million members
6.5MImpact: Data of 6.5 million members stolen; about $275 million in lost revenue
The UK's Co-op detected attempts at unauthorized access to its network in late April 2025 and shut down some IT systems. The attackers broke in by using social engineering to reset employee passwords, and it was later confirmed that data on all 6.5 million members had been stolen. Back-office, call center and product supply operations were disrupted, and the company reported a revenue loss of about $275 million.
Related reports: 30 · last report →Nova Scotia Power ransomware attack leaks customer data
300KImpact: Personal information of about 300,000 people
Nova Scotia Power was hit by a ransomware attack that stole customer information and disrupted operations. In May 2025 it notified 280,000 people of the leak, and in July the number of victims was reported at about 300,000. The company carried out its incident response and released a partially redacted final report.
Related reports: 22 · last report →Class action filed over Interior Health's 2009 data breach
A class action has been filed over a data breach at Interior Health in 2009. Former employees pursued the lawsuit, alleging that the breach had been covered up. The specific scale and cause of the breach have not been confirmed.
Related reports: 12 · last report →TeleMessage, used by US government officials, hacked and data stolen
Impact: Data theft and service suspension
TeleMessage, a modified Signal service used by US government officials, was hacked and data was stolen. The service, which Mike Waltz used to archive messages, suspended operations after the hacking allegations surfaced. US Customs and Border Protection also confirmed it had used the service.
Related reports: 11 · last report →About 100 employee logins stolen from Australia's Big Four banks
100Impact: About 100 employee login credentials
About 100 sets of login credentials belonging to employees of Australia's Big Four banks were stolen by cybercriminals. The theft became known from late April 2025, and experts warned that the credentials could be used by hackers to gain access.
Related reports: 3 · last report →