Week 30, 2025 security incident report
Hacking and data breach incidents newly reported 2025.07.21 ~ 07.27
From July 21 to 27, 2025, five new incidents were recorded in South Korea, the most prominent being a VPN intrusion at Haesung DS that leaked the personal data of 73,975 shareholders, employees and partner-company staff and infected an internal file server with ransomware. Other key issues included the deletion of a database following unauthorized intrusion at Jeonnam Technopark, personal data leaks and their recurrence at the Daesung Institute for Educational Development and Daesung Academy affiliates, and apartment security measures prompted by the hacking of wall pads that exposed 400,000 households nationwide. Across all types in South Korea and abroad, personal data leaks were the most common at 21, followed by hacking/intrusion (11), ransomware (5) and DDoS (1). Overseas, of 33 new incidents, the leak of data on 1.1 million customers of Allianz Life in the US and the breach of about 100 organizations through attacks on a SharePoint server vulnerability stood out, with the US National Nuclear Security Administration (NNSA) named as a target of chain-reaction damage.
By type
- Data breach19
- Hacking & intrusion11
- Ransomware5
- DDoS1
Key incidents in South Korea
Haesung DS VPN intrusion leaks personal data of 73,975 people
74KImpact: Personal information of 73,975 shareholders, employees and partner company staff leaked, and internal file server infected with ransomware
In October 2023, an intrusion exploiting an SSL-VPN vulnerability at Haesung DS leaked the personal information of 73,975 shareholders, employees and partner company staff, and infected an internal file server with ransomware. The company was found to have neglected security updates and anti-malware measures, and in July 2025 it was fined 343 million won.
Related reports: 4 · last report →Unauthorized intrusion into Jeonnam Technopark system deletes database
Impact: Deletion of the Jeonnam Science and Technology Information System database
A hacker gained unauthorized access to Jeonnam Technopark's Jeonnam Science and Technology Information System, deleted its database and left a threatening message demanding money. The investigation found poor management of accounts, passwords and access controls, among other failings. The Personal Information Protection Commission (PIPC) imposed a penalty surcharge of 98 million won and an administrative fine of 3.6 million won.
Related reports: 2 →Daesung Institute for Academic Development leaks test-takers' personal data
Impact: Personal information of test-takers
Personal information of test-takers was leaked from the Daesung Institute for Academic Development. The scale and timing of the leak, its cause and the response have not been confirmed.
Read on 전자신문 ↗Wall pad hack exposing 400,000 homes across South Korea prompts apartment security measures
Impact: 400,000 households across South Korea exposed
An incident in which a wall pad hack exposed 400,000 households across South Korea was covered. IPScan HomeGuard was proposed as a security measure for existing apartment complexes.
Read on 데일리시큐 ↗Another personal data leak at Daesung Academy affiliate
Another personal data leak occurred at an affiliate of Daesung Academy. The name of the affected affiliate, the scale of the leak and response measures have not been confirmed.
Read on 뉴스저널리즘 ↗
Supply-chain breaches
About 100 organizations breached in attacks exploiting SharePoint Server vulnerabilities
Impact: About 100 organizations breached
About 100 organizations were affected by attacks targeting vulnerabilities in Microsoft SharePoint Server. Following the US government, the energy sector and universities, a breach at the US agency that manages nuclear weapons also came to light. Microsoft and the US Cybersecurity and Infrastructure Security Agency (CISA) warned of attacks targeting on-premises SharePoint servers, and some of the attacks were linked to China-linked groups.
Related reports: 7 · last report →
Key incidents in other countries
Allianz Life hack in the US leaks data of 1.1 million customers
1.1MImpact: Personal information of 1.1 million customers
Allianz Life in the US was hit by a cyberattack that leaked customers' personal information. It was initially disclosed that most of its 1.4 million US customers were affected, and the scale of the damage was later specified as 1.1 million people. The attack was linked to a cloud-based customer relationship management system.
Related reports: 15 · last report →Central Maine Healthcare data breach affects about 145,000 people
145KImpact: Information on about 145,000 people
Information on about 145,000 people was leaked from Central Maine Healthcare. Six class actions over the breach had been filed by July 2025, and the scale of the damage became known in January 2026. In August 2026 the company agreed to a $1.3 million settlement, with payments of up to $5,000 to affected patients said to be possible.
Related reports: 7 · last report →About 100 organizations breached in attacks exploiting SharePoint Server vulnerabilities
Impact: About 100 organizations breached
About 100 organizations were affected by attacks targeting vulnerabilities in Microsoft SharePoint Server. Following the US government, the energy sector and universities, a breach at the US agency that manages nuclear weapons also came to light. Microsoft and the US Cybersecurity and Infrastructure Security Agency (CISA) warned of attacks targeting on-premises SharePoint servers, and some of the attacks were linked to China-linked groups.
Related reports: 7 · last report →Dell test platform breach leaks test data
Impact: Leak of fake data from the test and demonstration platform
Dell confirmed that its test and demonstration platform had been breached by the extortion group World Leaks. Dell said the data stolen and leaked by the attackers was fake data.
Related reports: 6 · last report →NASCAR ransomware attack exposes Social Security numbers and other data
Impact: Personal information including Social Security numbers
NASCAR was hit by a cyberattack in March 2025 and had personal information stolen. NASCAR confirmed the data breach in July, and the leaked information included Social Security numbers. Lawyers subsequently launched an investigation into the incident.
Related reports: 5 · last report →