Week 37, 2025 security incident report
Hacking and data breach incidents newly reported 2025.09.08 ~ 09.14
From September 8 to 14, 2025, five new incidents were recorded in South Korea, with the KT illegal femtocell breach, which leaked the personal data of 16,647 people and caused about 240 million won in unauthorized micropayments affecting 368 people, drawing the most attention. Personal data incidents continued across multiple sectors, including the leak of personal data of 182 people from the National Health Insurance Service's long-term care portal and a fine over the leak of data on 230,000 Moncler customers, and the damage was also reported to have widened after the leak of identification numbers of 5,561 subscribers. Across all types, personal data leaks were the most common at 47, followed by hacking/intrusion (16) and ransomware (8). Overseas, 69 new incidents were recorded, with malware designed to steal crypto assets inserted into 18 to 19 major npm packages, and data leaks at Plex and the Pierce County Library also drew attention.
By type
- Data breach46
- Hacking & intrusion16
- Ransomware6
- Phishing & smishing2
- Malware1
Key incidents in South Korea
Illegal femtocell breach at KT exposes personal data of 16,647 people
16.6KImpact: Personal information of 16,647 people exposed; 368 people incurred approximately KRW 240 million in unauthorized mobile micropayment charges
A breach at KT involving illegal miniature base stations known as femtocells exposed the personal information of 16,647 people, while 368 people suffered approximately KRW 240 million in unauthorized mobile micropayment charges. Investigators confirmed access to the internal network using cloned certificates and management failures, and KT announced a program waiving early termination fees and providing compensation. The Personal Information Protection Commission (PIPC) announced an administrative fine of KRW 53.979 billion and a criminal referral over obstruction of its investigation in July 2026, with further inquiries and criminal investigations still ongoing in November.
Related reports: 133 · last report →NHIS long-term care portal leaks personal data of 182 people
182Impact: Personal data of 182 people
The personal data of 182 people was leaked from the National Health Insurance Service (NHIS) long-term care portal. The NHIS apologized for the leak and said it would prepare measures to prevent a recurrence, and it launched an internal audit a week after the incident.
Related reports: 3 · last report →Identifiers of 5,561 subscribers leaked, damage widens
5.6KImpact: Identifiers of 5,561 subscribers leaked, with damage later widening
Just one day after an assurance that no personal information had been leaked, the leak of identifiers belonging to 5,561 subscribers was confirmed. On September 18, 2025, it emerged that the damage had grown further, along with news of an apology. The name of the affected organization and the specific attack method have not been confirmed.
Related reports: 2 · last report →Moncler fined over leak of 230,000 customers' personal data
230KImpact: Personal data of 230,000 customers
The personal data of 230,000 Moncler customers was leaked. A fine was imposed over the leak, and the timing and cause of the leak and the amount of the fine have not been confirmed.
Read on 보안뉴스 ↗Korea University responds to controversy over leaked National Assembly security task force list
Regarding the controversy over the leak of a list of members of a National Assembly security inspection task force, Korea University said the list was not confidential material. Korea University said the incident had been excessively blown out of proportion. The specific circumstances of the leak and the scale of damage have not been confirmed.
Read on 인더스트리뉴스 ↗
Supply-chain breaches
Fallout continues from breach at AI chatbot firm Salesloft
A data breach occurred at AI chatbot company Salesloft. The fallout from the breach continues, and the specific scale of the damage, attack method and response measures have not been confirmed.
Read on Krebs on Security ↗
Also affected: 4- SalesforceData theft attacks targeting Salesforce customers spreadHundreds of customers affected; attackers claim theft of 1.5 billion records
- ZscalerZscaler customer data leaked in Salesloft Drift breachCustomer information leaked, scale unknown
- TaniumSome Tanium information compromised in Salesloft Drift hack falloutSome basic information
- QualysQualys Salesforce data leaked in Drift supply chain attackSalesforce data leaked, scale unknown
Key incidents in other countries
Crypto-stealing malware injected into major npm packages
Impact: Malware injected into 18 to 19 major npm packages
Major npm JavaScript packages, including debug and chalk, were hacked and injected with malware designed to steal crypto assets. The supply chain attack was triggered by a phishing email and affected packages with billions of downloads. Counts of compromised packages differ, at 18 or 19.
Related reports: 7 · last report →Plex asks users to reset passwords after data breach
A data breach occurred at Plex, and the company asked users to reset their passwords. It advised server operators to upgrade. The scale of the breach and the specific cause have not been confirmed.
Related reports: 7 · last report →Massive leak of data on China's internet censorship technology
Impact: Censorship technology data claimed to total about 600GB
A massive trove of data related to the Great Firewall, China's internet censorship system, was leaked. Data claimed to total about 600GB was released, and the leaked material revealed how Chinese companies export censorship technology overseas.
Related reports: 6 · last report →Pierce County Library cyberattack leaks data of 340,000 people
340KImpact: Personal information of more than 340,000 people
Pierce County Library in Washington state was hit by a cyberattack that leaked personal information. In September 2025, a lawsuit alleging negligence and the exposure of more than 300,000 personal records came to light, and in December the number of victims was put at more than 340,000.
Related reports: 5 · last report →Personal data of Pakistani citizens and officials leaked online
Impact: Personal data of thousands of citizens and public officials, exposed on more than 1,300 websites
The personal data of thousands of Pakistani citizens and public officials was leaked online, with the information exposed on more than 1,300 websites. The interior minister set up an investigative body, and the Pakistan Telecommunication Authority denied claims that data had leaked from the telecom sector.
Related reports: 5 · last report →