Week 20, 2025 security incident report
Hacking and data breach incidents newly reported 2025.05.12 ~ 05.18
From May 12 to 18, 2025, seven new cybersecurity incidents were recorded in South Korea, with the breach of Dior's customer management service, which exposed customers' names, contact details, addresses and purchase information, drawing the most attention at 29 articles. Personal data harm stood out in retail, fashion and finance, including Temu's unauthorized transfer and processing of South Korean users' personal information, a leak of Adidas customer data and a savings bank personal data leak affecting 220,000 people. Across all incident types in South Korea and abroad, personal data leaks numbered 29, far outpacing 9 hacking/intrusion cases and 6 ransomware attacks, and chain-reaction damage was also identified, spreading from Co-op to Nisa Retail Limited and from MBE CPAs to MedicareCompareUSA. Overseas, of 38 new incidents, the Coinbase case, in which bribed customer support staff led to the leak of personal data of 69,461 customers, received the most coverage, while Nucor halted part of its production and Broadcom data was leaked following a ransomware attack on a payroll service provider.
By type
- Data breach28
- Hacking & intrusion9
- Ransomware6
- Phishing & smishing1
Key incidents in South Korea
Dior customer data leaked via breach of customer management service
Impact: Personal data including customer names, phone numbers, addresses and purchase information
Customer personal data was leaked at Dior in January 2025, but the company only became aware of the incident in May. Employee credentials used to access an external customer management service were abused, exposing customer names, phone numbers, addresses, purchase information and more. Dior notified and apologized to affected customers, saying financial account and card information was not included in the breach.
Related reports: 29 · last report →Kim Jae-joong reveals he was a victim of KakaoPay hacking
Kim Jae-joong disclosed that he had been a victim of KakaoPay hacking. He also complained that the support he received was inadequate.
Related reports: 6 · last report →Temu leaked and processed South Korean users' personal data without consent
Impact: Personal information of South Korean users
It came to light that Temu had leaked South Korean users' personal information without authorization and processed facial data and resident registration numbers without authorization. Temu was fined 1.3 billion won for privacy violations.
Related reports: 4 · last report →Adidas hack exposes customer names, contact details and more
Impact: Customers' personal information, including names, addresses, email addresses and phone numbers
Personal information of Adidas customers, including names, addresses, email addresses and phone numbers, was leaked. Adidas said it had been hit by a hacking attack and that customer email addresses, phone numbers and other details may have been leaked.
Related reports: 3 · last report →Leak of 220,000 people's data puts savings banks' internal controls under scrutiny
220KImpact: Personal information of 220,000 people
The personal information of 220,000 people was leaked. The incident heightened tension over savings banks' internal controls.
Read on 헤럴드경제 미주판 ↗SK Group moves to strengthen security across all affiliates amid hacking controversy
Amid criticism over hacking, SK Group decided to strengthen security across all its affiliates. As a response measure, it moved to establish a special information protection committee.
Read on 지디넷코리아 ↗Information of disclosure-request filers leaked, followed by pressure and protests
Impact: Information of people who filed information disclosure requests
The information of people who had filed freedom-of-information requests was leaked. In connection with the leaked information, the filers were subjected to persuasion attempts and protests.
Read on KBS 뉴스 ↗
Supply-chain breaches
Oracle Health hack leaks patient data of about 20 million people
20MImpact: Patient data of about 20 million people
Oracle Health was hacked in 2025, leaking patient data. The US Federal Bureau of Investigation investigated the attack, and leaks affecting healthcare providers were later disclosed. The scale confirmed in October 2026 is about 20 million people.
Related reports: 12 · last report →
UK Co-op hack exposes data of 6.5 million members
6.5MImpact: Data of 6.5 million members stolen; about $275 million in lost revenue
The UK's Co-op detected attempts at unauthorized access to its network in late April 2025 and shut down some IT systems. The attackers broke in by using social engineering to reset employee passwords, and it was later confirmed that data on all 6.5 million members had been stolen. Back-office, call center and product supply operations were disrupted, and the company reported a revenue loss of about $275 million.
Related reports: 30 · last report →
Also affected: 1Lawsuit investigation into MBE CPAs data breach
A lawsuit investigation was conducted in connection with a data breach at MBE CPAs. The date of the breach, the scale of the damage, the cause and response measures have not been confirmed.
Read on ClassAction.org ↗
Key incidents in other countries
Bribed Coinbase support staff leak data of about 70,000 customers
69.5KImpact: Personal information of 69,461 customers
Attackers bribed Coinbase support staff to steal customers' personal information, including copies of passports, and the number of victims was confirmed at 69,461. The attackers demanded $20 million, but Coinbase refused and instead offered a bounty of the same amount for information on the attackers. Coinbase expected the cost of the incident to reach up to $400 million, and in December 2025 a former support agent linked to the case was arrested in India.
Related reports: 43 · last report →Valve denies system breach amid claims of 89 million leaked Steam accounts
Impact: Phone numbers leaked; scale of damage unconfirmed
Claims surfaced that data from 89 million Steam accounts had been leaked. Operator Valve denied that its systems were breached or that account information was leaked, and said passwords were safe. The leaked data was described as phone numbers, and the claimed number of accounts has not been confirmed as the actual scale of the damage.
Related reports: 9 · last report →Nucor cyberattack halts some production, data stolen
Impact: Temporary production halt at several sites and limited data leak
In May 2025, US steelmaker Nucor took some networks offline and temporarily halted production at several sites in response to a cyberattack. The company disclosed the incident and recovery work in a filing with the US Securities and Exchange Commission. In June, it restored operations and confirmed a limited data leak.
Related reports: 7 · last report →Andy Frain Services ransomware attack affects 100,000 people
100KImpact: 100,000 people affected
Security company Andy Frain Services said a ransomware attack affected 100,000 people. A potential lawsuit over the data breach was also being investigated. When the attack occurred, what specific data was leaked and what recovery steps were taken have not been confirmed.
Related reports: 2 →Ransomware attack on payroll provider leaks Broadcom data
Payroll service provider Business Systems House was hit by a ransomware attack, and Broadcom's data was stolen. The leak was reported on May 16, 2025, and the scale of the damage and response measures have not been confirmed.
Related reports: 2 · last report →