Week 32, 2025 security incident report

YES24 hit by ransomware again, all services go offline

Impact: Access to all services suspended for about 7 hours

YES24 was hit by a ransomware attack at around 4:30 a.m. on August 11, 2025, cutting off access to all of its services. In an attack that followed the June incident, YES24 urgently shut down its systems and restored from backups. Services returned to normal at around 11:20 a.m. the same day, and the Korea Internet & Security Agency (KISA) launched an on-site investigation.

Government systems including Interior Ministry's Onnara system hacked

Suspicions were raised of hacking, presumed to be the work of North Korea, targeting the Ministry of the Interior and Safety, the Ministry of Foreign Affairs and the Defense Counterintelligence Command. On October 17, 2025, the government confirmed traces of hacking in systems including the Onnara system.

Circle Chart hack leaks 65,394 personal data records

65.4KImpact: 65,394 personal data records and 3,856 resident registration numbers

A hack of the Circle Chart website, operated by the Korea Music Content Association, leaked 65,394 personal data records, including names, user IDs, passwords and email addresses, as well as 3,856 resident registration numbers. The association apologized for how the additional scale of the leak was identified following the May 2025 breach and for the delay in notification.

Dragonfly website paralyzed for a month by ransomware attack

Impact: Website paralyzed for a month

Game company Dragonfly was hit by a ransomware attack that paralyzed its website for a month. Dragonfly declined technical support from the Korea Internet & Security Agency (KISA).

Order Nine kiosk hacked as phishing sites appear

The Order Nine kiosk was hacked, and phishing sites also appeared. The operator's official name, the scale of the damage, the date of the incident and response measures are unknown.

Google Salesforce system breach exposes advertising customer data

2.5MImpact: Data of 2.5 million advertising customers

Google's internal Salesforce system was breached, exposing customer information including business contact details of advertising customers. Voice phishing impersonating IT support was identified as the attack method, and the data of 2.5 million advertising customers was reportedly leaked. Google later denied claims that 2.5 billion Gmail users had been hacked. The attackers demanded the firing of security experts and threatened further data leaks.

Air France-KLM customer data leaked via third-party platform hack

Impact: Personal information of Air France and KLM customers

Customer information of Air France and KLM was leaked through a hack of a third-party platform. The two airlines disclosed the leak on August 7, 2025, and subsequently urged customers to be vigilant. The specific scale of the damage and the date of the incident have not been confirmed.

Cisco hit by voice phishing, website user data stolen

Impact: Profile information of users registered on Cisco.com

Cisco was hit by a voice phishing attack, and user information was stolen from its customer relationship management system. The leaked data included profile information of users registered on Cisco.com. Cisco disclosed the data breach affecting user accounts.

US federal court e-filing system breach exposes sealed records

Impact: Sealed court records in multiple states exposed

The US federal courts' electronic case management and filing system was breached, exposing sealed court records in multiple states. Security flaws known since 2020 were exploited in the attack, and Russian government hackers are suspected of involvement. With the possible exposure of the identities of confidential informants and cooperating witnesses, some courts switched to paper filings.

Hacker claims Nokia internal network breach and leak of 94,000+ employees' data

94KImpact: Claimed leak of data on more than 94,000 employees

A hacker claimed to have breached Nokia's internal network. The hacker claimed to have leaked data on more than 94,000 employees; whether a breach actually occurred and Nokia's response have not been confirmed.