Week 39, 2025 security incident report
Hacking and data breach incidents newly reported 2025.09.22 ~ 09.28
From September 22 to 28, 2025, 15 new cybersecurity incidents were recorded in South Korea, with the leak of data on 3 million customers of a credit card company being the largest incident by the number of victims cited. A variety of data leaks followed in the financial, public and education sectors, including the personal data of 120,000 researchers at the National Research Foundation, sensitive health-related information at the Korea Disease Control and Prevention Agency and gift certificate PIN numbers at BiplPay. A ransomware attack on GJTech leaked internal documents of some 20 asset management firms, causing chain-reaction damage, and security concerns over hacks of telecom and card companies, along with controversy over cover-ups, downplaying and whether the incidents could have been prevented, also came to the fore. Overseas, 46 incidents were recorded, with the leak of children's data at the Kido childcare chain and operational disruptions at Heathrow, Berlin Brandenburg and Brussels airports following a ransomware attack on Collins Aerospace's check-in system standing out.
By type
- Data breach30
- Hacking & intrusion18
- Ransomware10
- Phishing & smishing1
Key incidents in South Korea
BePle Pay prepaid gift card PINs leaked
Impact: Prepaid top-up gift card PINs
PINs for prepaid top-up gift cards were leaked from BePle Pay in a hack. BePle Pay confirmed the leak of mobile gift card PINs.
Related reports: 3 · last report →Data of 3 million customers leaked at South Korean credit card company
3MImpact: Data of 3 million customers leaked
A data breach affecting 3 million customers occurred at a South Korean credit card company, prompting an investigation by the authorities. On September 24, 2025, MBK Partners Vice Chairman Yoon Jong-ha appeared as a witness in an inquiry into the hacking incident.
Related reports: 2 · last report →Research foundation hack exposes personal data of 120,000 researchers
120KImpact: Personal information of 120,000 researchers
The personal information of 120,000 researchers was leaked in a hack at a research foundation. Critics pointed out that the data was leaked through a rudimentary hack despite a security budget of 4.8 billion won, and that there were no improvement measures.
Related reports: 2 · last report →SK Telecom, KT and Lotte Card hacks fuel security fears
Following SK Telecom, hacking issues were raised at KT and Lotte Card in succession. The string of hacks fueled growing anxiety over cybersecurity in South Korea.
Related reports: 2 · last report →GJTech ransomware attack exposes data of some 20 asset managers
Impact: Internal data of about 20 asset management firms
IT management firm GJTech was attacked by the Qilin ransomware group. Internal data of about 20 asset management firms using its file server service was found to have been leaked. Awesome Asset Management announced on September 8, 2025, that it had confirmed a ransomware infection on the file server.
Related reports: 2 →KDCA leaks sensitive personal data through misdirected texts and other errors
Impact: Sensitive health-related personal information
Personal information was leaked at the Korea Disease Control and Prevention Agency through misdirected text messages and other errors. The leaked information included sensitive health-related data.
Related reports: 2 →Trade ministry's contest website hacked, unnoticed for over a month
A contest website run by the Ministry of Trade, Industry and Energy was hacked. The breach went unnoticed for more than a month.
Read on 경향신문 ↗Lotte Card and KT hacks spark debate over whether they were preventable
Hacking incidents occurred at Lotte Card and KT. Questions were raised about whether the two incidents were preventable man-made disasters.
Read on 경향신문 ↗Prime Minister Kim warns of accountability for any cover-up or downplaying of KT, Lotte Card hacks
Hacking incidents occurred at KT and Lotte Card. Prime Minister Kim said those responsible would be held accountable if there had been any cover-up or downplaying of the incidents.
Read on 조선일보 ↗UWAY Apply hacked, raising concerns over applicants' personal data
UWAY Apply was hacked. Concerns were raised about the security of college applicants' personal information.
Read on 뉴스저널리즘 ↗
Supply-chain breaches
Ransomware attack on aviation tech provider disrupts European airports
Impact: Check-in system outages at major European airports and flight delays and cancellations
A cyberattack on a US-based aviation technology provider caused outages in check-in systems at major European airports in September 2025. Flight delays and cancellations followed, and the European Union confirmed ransomware was the cause. UK police arrested a man in connection with the attack.
Related reports: 36 · last report →
Also affected: 1- Dublin AirportDublin Airport delays continue after cyberattackOngoing airport delays
Collins Aerospace ransomware attack disrupts check-in at European airports
Impact: Check-in outages and delays at London Heathrow, Brussels and Berlin airports
Collins Aerospace's airport check-in system was hit by a cyberattack, causing check-in outages and delays at London Heathrow, Brussels and Berlin airports in September 2025. The European Union Agency for Cybersecurity (ENISA) confirmed the cause was ransomware, and the company worked to restore its airline software. A suspect was later arrested in the UK, and Brussels Airport and the company moved to replace the check-in system.
Related reports: 6 · last report →
Also affected: 2- Heathrow AirportCyberattack on Heathrow check-in systems delays flightsCheck-in system disruption and flight delays
- Berlin Brandenburg AirportCyberattack fallout disrupts operations at Berlin Brandenburg AirportOngoing disruption to airport operations
Key incidents in other countries
Kido nursery hack leaks children's photos, names and addresses
8KImpact: Children's photos, names and addresses leaked; 8,000 children according to the attackers
Nursery chain Kido was hacked and children's photos, names and addresses were stolen. The attackers claimed to have obtained data on 8,000 children, threatened further releases and urged parents to pressure the nurseries into paying a ransom. The attackers later claimed to have deleted the data, and two teenagers were arrested in the UK in connection with the case.
Related reports: 11 · last report →Boyd Gaming cyberattack leaks employee data
11KImpact: Employee data leaked; lawsuit claims at least 11,000 people could be affected
US casino operator Boyd Gaming was hit by a cyberattack in which employee information was stolen. The company disclosed the data breach, and a lawsuit was later filed. The lawsuit claimed that at least 11,000 people could be affected.
Related reports: 7 · last report →Ransomware attack on RTX airline check-in system disrupts airport operations
Impact: Disruption to airport check-in and airline boarding software
RTX's airline check-in and boarding software was hit by a ransomware attack, disrupting airport check-in. The European Union's cybersecurity agency confirmed on September 22, 2025, that the outage was caused by ransomware, and RTX also confirmed the attack. A suspect was arrested in the UK in connection with the attack.
Related reports: 7 · last report →Harrods IT system breach leaks 430,000 customer records
430KImpact: 430,000 customer records
A breach of Harrods' IT systems led to the leak of 430,000 customer records. Harrods warned customers that their data may have been stolen, and the hackers later contacted the company.
Related reports: 5 · last report →Data of about 17,000 Volvo North America employees leaked via supplier
17KImpact: Personally identifiable and health information of about 17,000 employees
The personally identifiable information and health information of about 17,000 Volvo North America employees was leaked. Employee data was stolen in a ransomware attack targeting Miljödata, an IT and HR services supplier, and Volvo confirmed the exposure of personal information.
Related reports: 5 · last report →