Week 25, 2025 security incident report
Hacking and data breach incidents newly reported 2025.06.16 ~ 06.22
From June 16 to 22, a hack in South Korea in which the North Korean flag was broadcast during a church's YouTube livestream of a worship service emerged as a major incident, with related cases, including that of Onnuri Church, each reported. A hacking incident at a corporate insurance agency exposed a blind spot in security oversight of the insurance industry. Incident types overall were concentrated in personal data leaks (40) and hacking/intrusion (22), and chain-reaction damage spreading from United Natural Foods to Darlings Grocery, Whole Foods Market, Inc. and UBS Group AG also emerged. Overseas, a $177 million settlement over the AT&T customer data leak drew the most coverage, while the exposure of some 16 billion login credentials and large-scale leaks of personal and health data at Aflac and Episource also stood out.
By type
- Data breach39
- Hacking & intrusion22
- Ransomware4
- Malware2
- Phishing & smishing1
- DDoS1
Key incidents in South Korea
Hacked YouTube livestream of Korean church service airs North Korean flag
Impact: North Korean flag broadcast during a YouTube livestream of a church service
A YouTube livestream of a church service in South Korea was hacked, and the North Korean flag was broadcast during the stream. The name of the church, the specific extent of the damage and the response have not been confirmed.
Related reports: 2 · last report →North Korean flag airs during Onnuri Church service livestream
Impact: North Korean flag broadcast during a service livestream
A hacking incident caused the North Korean flag to be broadcast during a livestream of a service at Onnuri Church. The church launched an urgent investigation into the incident.
Related reports: 2 · last report →Hack at corporate insurance agency exposes gap in security oversight
A hacking incident at a corporate insurance agency exposed a regulatory blind spot in security oversight. Corporate insurance agencies had been outside the scope of security supervision because they are not classified as financial companies.
Read on 뉴스1 ↗
Supply-chain breaches
United Natural Foods cyberattack disrupts grocery supply
Impact: Disruption to operations and grocery supply, and projected lost sales of up to $400 million
Whole Foods supplier United Natural Foods suffered a cyberattack in June 2025 that disrupted its operations and grocery supply. The company took some systems offline, then worked on recovery and resumed order intake and shipments. In July, it projected that lost sales from the attack could reach up to $400 million.
Related reports: 16 · last report →
United Natural Foods hack disrupts grocery supply
Impact: Product shortages at some Whole Foods stores and projected lost sales of hundreds of millions of dollars
United Natural Foods, a major distributor for Whole Foods, was hit by a cyberattack that halted its systems and deliveries. Some Whole Foods stores experienced product shortages, and the company said in mid-June 2025 that recovery was under way. In July, it disclosed projected lost sales from the attack and a revised annual earnings outlook.
Related reports: 8 · last report →
Also affected: 2Chain IQ cyberattack leaks data linked to UBS and others
Impact: Data related to UBS, Pictet, KPMG and others
Chain IQ was hit by a cyberattack that resulted in a data leak. The leak affected several companies, including UBS, Pictet and KPMG.
Read on CPO Magazine ↗
Also affected: 1- UBSBreach at procurement firm Chain IQ leaks UBS employees' business contact detailsData of 130,000 UBS employees
Key incidents in other countries
16 billion login credentials for Google, Apple and others exposed online
16BImpact: About 16 billion login credentials
It was discovered that 16 billion login credentials for multiple services, including Google, Apple, Facebook and Telegram, had been exposed online. After it was confirmed that the data included previously leaked records, doubts were raised about interpreting it as a single new large-scale breach.
Related reports: 35 · last report →Aflac cyber intrusion exposes personal data of about 22.7 million people
22.7MImpact: Personal, health and insurance-related information of about 22.7 million people
U.S. insurer Aflac detected a cyber intrusion on June 12, 2025, and personal data as well as health and insurance-related information of customers, beneficiaries, employees and agents was stolen. The total number affected was later confirmed at about 22.7 million, of whom at least 13.9 million had protected health information compromised. The company said it had not been affected by ransomware and proceeded with notifying victims.
Related reports: 26 · last report →Episource ransomware attack leaks health data of over 5.4 million
5.4MImpact: Health information of more than 5.4 million patients
Healthcare services and technology company Episource was hit by a ransomware attack that leaked the health information of more than 5.4 million patients. The company notified millions of people that their health information had been stolen. US senators later criticized UnitedHealth's cybersecurity in connection with the incident and demanded an explanation.
Related reports: 12 · last report →Nobitex hack burns about $90 million in Iranian crypto
Impact: About $90 million in crypto assets stolen and effectively burned; service suspension
In June 2025, the infrastructure and hot wallets of Nobitex, Iran's largest crypto exchange, were breached, about $90 million in crypto assets was stolen and services were suspended. The pro-Israel hacking group Predatory Sparrow, which claimed the attack, sent the assets to addresses from which they are hard to recover, effectively burning them. An analysis of the leaked source code was later published.
Related reports: 11 · last report →Cyberattack on Iran's Bank Sepah disrupts banking and gas station services
Impact: Nationwide banking service outages and gas station service disruptions
Iran's Bank Sepah was hit by a cyberattack that caused nationwide service outages and also disrupted gas station services. A pro-Israel hacking group claimed responsibility for the attack and said it had destroyed the bank's data.
Related reports: 9 · last report →