Week 23, 2025 security incident report

Data of 120,000 researchers leaked from NRF paper submission system

120KImpact: Personal information of about 120,000 researchers

JAMS, the online paper submission system of the National Research Foundation of Korea (NRF), was hacked, leaking the personal information of about 120,000 researchers. The foundation initially said no personal information had been leaked but later acknowledged the leak and reported it. The Personal Information Protection Commission (PIPC) investigated how the leak occurred and whether security obligations had been met, and later imposed fines and penalties totaling 707.8 million won.

Three including police officer indicted for leaking Lee Sun-kyun probe details

Impact: Leak of investigation details in the case of actor Lee Sun-kyun

Three people, including a police officer and a prosecution investigator, were indicted on charges of leaking investigation details in the case of actor Lee Sun-kyun. The police officer and the prosecution investigator were indicted without detention.

Personal data of over 10,000 Goyang public parking users leaked

10KImpact: Names, contact details and license plate numbers of more than 10,000 public parking users

The personal data of more than 10,000 users of public parking lots in Goyang was leaked. The leaked information included users' names, contact details and vehicle license plate numbers.

Data from 7 million Netflix, Disney+ and other streaming accounts leaked

Impact: Personal data of 7 million streaming accounts

Personal data from 7 million accounts on streaming services such as Netflix and Disney+ was leaked. South Korea was among the affected countries, ranking seventh by scale of damage. Users were advised to change their passwords.

Hack of mobile coupon app Ilsang Cafe leaks up to 16 types of personal data

Impact: Up to 16 categories of customer personal data

The mobile coupon app Ilsang Cafe was hacked, leaking customers' personal data. Up to 16 types of personal data were reportedly leaked.

Chinese hackers breach US and South Korean telecom networks amid backdoor fears

Telecom networks in the US and South Korea were breached by Chinese hackers, and concerns were also raised about backdoor threats in the solar power sector. The specific affected organizations, scale, date of the incident and response were not specified.

Concerns raised over Chanel's response to data breach

Concerns were raised that Chanel has not issued a statement regarding its personal data breach. The leaked data items, the extent of the damage, the date of the incident and specific response measures have not been confirmed.

Hack of JAMS manuscript submission system raises fears of researcher data leak

Impact: Feared leak of data on tens of thousands of researchers

The JAMS manuscript submission system was hacked. There are concerns that data on tens of thousands of researchers was leaked, but whether data was actually leaked and the response have not been confirmed.

Unauthorized access to Cartier systems leaks customer data

Impact: Customer names, email addresses and countries of residence

An attacker gained unauthorized access to Cartier's systems and stole customers' names, email addresses and countries of residence. The company notified customers of the breach and said passwords and payment and banking information were not affected.

Customer accounts compromised on The North Face US website

Impact: Customer accounts compromised; possible access to names, shipping addresses and order histories

In April 2025, The North Face's US website was hit by a credential stuffing attack that compromised customer accounts. The attackers may have accessed names, shipping addresses and order histories, while customers' credit card information was confirmed to be safe. The company reset the passwords of the affected accounts.

India's KiranaPro has servers, app code and sensitive data wiped

Impact: Deletion of servers, app code and sensitive data

Indian grocery startup KiranaPro had its servers, app code and sensitive data deleted in a cyberattack. The CEO confirmed the hack and the deletion of the servers. A co-founder later said the possibility of an external hack could not be ruled out.

Taiwan's BitoPro exchange hacked, about $11.5 million stolen

Impact: About $11.5 million in crypto assets

Taiwanese crypto exchange BitoPro confirmed that it was hacked in May 2025 and that assets worth about $11.5 million were stolen. The investigation found that the intrusion came through social engineering targeting a cloud operations staff member and the installation of malware, and the exchange named the North Korean hacking group Lazarus as the attacker.

Former football coach accused of hacking female athletes' private photos

Impact: Alleged unauthorized access to private photos of thousands of female athletes

The US Department of Justice said a former football coach hacked private photos of thousands of female athletes. Some former college athletes were notified that the coach may have accessed their private photos without authorization. The specific intrusion method and the date of the incident have not been confirmed.