Week 35, 2025 security incident report
Hacking and data breach incidents newly reported 2025.08.25 ~ 08.31
From August 25 to 31, 2025, signs of access to the government's OnNara system and the leak of about 2,800 GPKI certificate verification logs emerged as a major incident in South Korea. A fine of 134.8 billion won was also finalized over liability for a personal data leak, putting both public system security and accountability for personal data leaks in the spotlight. New incidents totaled two in South Korea and 70 overseas, with personal data leaks (31) and hacking/intrusion (27) making up the majority. Overseas, data theft and the suspension of administrative services following a ransomware attack on the Nevada state government stood out, ransomware also disrupted operations and transit services at other public agencies, and TransUnion leaked the personal data of about 4.4 million people.
By type
- Data breach32
- Hacking & intrusion27
- Ransomware11
- Malware1
Key incidents in South Korea
Signs of government On-Nara system access and certificate log leak
2.8KImpact: Signs of a leak of about 2,800 GPKI certificate verification logs
Signs emerged that the On-Nara system had been accessed using government employees' accounts and that about 2,800 GPKI certificate verification logs belonging to government and bank employees had been leaked. Allegations were also raised that hacking targeting the Korean government began in January 2025 at the latest and was linked to the Chinese hacking group SLIME68. The government's fact-checking was ongoing, and whether the intrusion succeeded and the full extent of the damage had not been determined.
Related reports: 4 · last report →134.8 billion won fine finalized over personal data leak
A fine of 134.8 billion won was finalized as a penalty for a personal data leak. The sanctioned organization and the scale of the leak have not been confirmed.
Read on 톱데일리 ↗
Key incidents in other countries
Ransomware attack disrupts Nevada state government services
Impact: Theft of state data and disruption of government services including offices, websites and phones; $1.5 million in response costs
After discovering a cyberattack on August 24, 2025, the Nevada state government temporarily closed its offices and suspended some websites and phone services. Emergency services remained in operation, and although the state initially said there was no evidence of a personal data breach, it later confirmed a ransomware attack and the theft of state data. The attack was traced to a state employee installing a system administration tool containing malware, and the state spent $1.5 million on its response without paying a ransom.
Related reports: 37 · last report →TransUnion hack exposes data of 4.4 million US consumers
4.4MImpact: Personal information of about 4.4 million US consumers
TransUnion said a hack had exposed the personal information of about 4.4 million US consumers. The Social Security numbers of about 17,000 Rhode Island residents were also exposed. The company confirmed that the breach notification letters sent to consumers were genuine, and a class action lawsuit was filed over the data breach.
Related reports: 23 · last report →Ransomware disrupts Pennsylvania Office of Attorney General operations
Impact: Outages of internal systems, website, email and phones; delays in case processing; leak of personal information including Social Security numbers
The Pennsylvania Office of Attorney General in the United States was hit by a ransomware attack in August 2025 that encrypted files and disrupted access to email, documents and internal systems. Court case processing and operations were delayed, and the office did not pay a ransom, handling some work through alternative means. It later confirmed the leak of personal information, including Social Security numbers, and notified residents.
Related reports: 10 · last report →Maryland Transit Administration ransomware attack disrupts transit services
Impact: Disruption to paratransit services and real-time bus location information, and data exposure
The Maryland Transit Administration in the US was hit by a cyberattack that disrupted paratransit services for people with disabilities and real-time transit information in August 2025. The agency arranged temporary transportation, and paratransit services were restored about a month later. The Rhysida ransomware group claimed responsibility for the attack and demanded $3.4 million, and state officials said they did not pay the ransom.
Related reports: 8 · last report →University of Iowa Community HomeCare breach affects about 211,000 people
211KImpact: Information on about 211,000 people
Community HomeCare, part of the University of Iowa health system, suffered an intrusion in July in which patient and client files were viewed and copied. About 211,000 people were affected, and depending on the individual, the data may have included names, Social Security numbers, and insurance and medical information. Community HomeCare disclosed the breach.
Related reports: 6 · last report →