Week 36, 2025 security incident report

Lotte Card hack leaks personal data of 2.97 million customers

3MImpact: Personal data of 2.97 million customers

Signs of hacking and malware infection on servers were found in Lotte Card's online payment system, and the leak of personal data of 2.97 million customers was later revealed. The leaked data included card numbers, CVC codes and resident registration numbers. Lotte Card carried out customer protection measures and compensation, followed by a fine, a business suspension penalty and a class action.

LG Uplus suspected of leaking server, account and employee data

167Impact: Suspected leak of data on 8,938 servers, 42,526 accounts and 167 employees; extent of damage not determined

In September 2025, allegations emerged that data on 8,938 LG Uplus servers, 42,526 accounts and 167 employees had been leaked, prompting a government investigation. LG Uplus maintained that its own investigation found no evidence of a breach, but reported signs of hacking to KISA in October. Controversy then continued over the disposal of suspected compromised servers, the reinstallation of operating systems and the submission of investigation materials, leading to a police investigation and claims of inadequate evidence preservation.

KT confirmed to have had malware-infected servers and failed to report incident

Impact: 43 servers confirmed infected with malware

Between March and July 2024, KT discovered 43 servers infected with malware including BPFDoor and handled them on its own without reporting. In a company-wide server inspection in September 2025, it found traces of intrusion and suspicious signs and reported them to the Korea Internet & Security Agency. A government investigation revealed the malware infections and the failure to report; KT apologized and announced plans to build an integrated monitoring system. Controversy continued afterward over log deletion and the submission of materials.

Tampered Nexon Blue Archive CDN settings cause abnormal content exposure

Impact: Abnormal exposure of some content

An external attacker accessed the CDN configuration of Nexon's Blue Archive and altered the settings without authorization, causing some content to be displayed abnormally. Nexon carried out emergency maintenance and blocked the attacker's access. It said user accounts, game data and payment information were not affected.

Jeju middle school student obtains personal data of about 400 students without authorization

400Impact: Personal information of about 400 students and performance assessment grades of about 200

A student at a middle school in Jeju, South Korea, gained unauthorized access to a teacher's Google Workspace account whose initial password had never been changed. The student downloaded the personal information of about 400 students and the performance assessment grades of about 200. The school reported the leak, deleted the data and changed passwords, and no external distribution has been confirmed.

Allegations of personal data leak to keep cooperative head post

Allegations have been raised that personal information was leaked in order to retain the position of cooperative head. The cooperative and individuals involved, the scale of the leak and whether the allegations are true have not been confirmed.

Jaguar Land Rover cyberattack causes data leak and production halt

Impact: Data leak and prolonged production halt; company costs exceeding $220 million

Jaguar Land Rover suffered a cyberattack in 2025 that led to a data leak and a prolonged production shutdown. The shutdown also affected parts supply and vehicle sales, and the company's direct costs reportedly exceeded $220 million. Resumption of UK production was reported in November 2025, and the possibility of Russian hackers and a state-sponsored attack was later raised.

Wealthsimple supply chain attack leaks customer personal data

Impact: Personal information and Social Insurance Numbers of some customers

A supply chain attack on Canadian investment platform Wealthsimple leaked customers' personal information, and some Social Insurance Numbers were also accessed without authorization. A third-party software vulnerability was identified as the breach vector. Wealthsimple executives apologized to customers and said account information had not been misused.

Navy Federal Credit Union exposes 378GB of files through server misconfiguration

Impact: 378GB of files

378GB of Navy Federal Credit Union files were exposed through a misconfigured server. The exposed material included backup files, and when the incident occurred and the response measures have not been confirmed.

Palo Alto Networks customer data and support cases leaked

Impact: Customer information and support case records

Palo Alto Networks confirmed unauthorized access to customer data via Salesforce. The leaked information included customer information and support case records. The scale of the damage and the specific date of occurrence have not been confirmed.

Chess.com file transfer app breach exposes 4,500 people's data

4.5KImpact: Information of 4,500 people

Chess.com suffered a data breach via a file transfer app in June 2025. Chess.com disclosed that the information of 4,500 people was stolen in the incident.