Week 41, 2025 security incident report
Hacking and data breach incidents newly reported 2025.10.06 ~ 10.12
In South Korea, the infiltration of the government's OnNara system for about three years using stolen certificates was the most prominent incident, with the administrative digital signature certificates of about 650 public officials and the passwords of 12 stolen and internal documents viewed. As questions were raised about Chinese and North Korean involvement in the hacking of the South Korean government and the CEOs of the three major telecom carriers were summoned to a parliamentary audit over hacking incidents, both public sector breaches and the telecom industry's accountability drew attention. New incidents totaled three in South Korea and 35 overseas, with personal data leaks (21) and hacking/intrusion (14) dominating by type. Overseas, safety concerns for affected Afghans and their families following a leak of their data, data theft exploiting an Oracle software vulnerability that is estimated to have affected more than 100 companies, and the leak of personal data of 6 million VTEX shoppers stood out.
By type
- Data breach20
- Hacking & intrusion13
- Ransomware2
- Phishing & smishing1
Key incidents in South Korea
Questions raised over Chinese and North Korean role in South Korean government hacks
Whether China or North Korea was behind hacking incidents targeting the South Korean government emerged as an issue. The specific affected agencies, the timing, the extent of the damage and response measures have not been confirmed.
Read on The Diplomat – Asia-Pacific Current Affairs Magazine ↗CEOs of three major carriers summoned to parliamentary audit over hacking
The CEOs of South Korea's three major telecom carriers were all summoned to the National Assembly's annual audit over hacking issues. Carrier hacking emerged as a key issue in the audit of the IT sector.
Read on 중앙일보 ↗
Key incidents in other countries
Afghan data leak raises safety fears for those affected and their families
Information about Afghans was leaked, raising concerns about the safety of those affected and their families. One study suggested that at least 49 relatives and colleagues of people whose data was leaked may have died. Controversy followed over allegations that the government downplayed the risks and over a reporting ban, and a related closed appeal court ruling was made public.
Related reports: 7 · last report →Data stolen from many companies via Oracle software vulnerability
Impact: More than 100 companies estimated to be affected
Data from many organizations was stolen in attacks exploiting a zero-day vulnerability in Oracle E-Business Suite. The attacks were identified as an extortion campaign linked to Clop, and initially dozens of victims were known. Google later estimated that more than 100 companies had been affected.
Related reports: 5 · last report →E-commerce company VTEX leaks data of 6 million shoppers
6MImpact: Personal information of 6 million shoppers
The personal information of 6 million shoppers was leaked at global e-commerce company VTEX. The timing of the incident, the cause of the leak and the response have not been confirmed.
Related reports: 2 · last report →Avnet internal sales tool data leaked
Impact: Internal sales tool data leaked
Electronic components company Avnet confirmed a data breach involving information from an internal sales tool. Avnet said the stolen data was unreadable.
Related reports: 2 →PancakeSwap's Chinese X account hacked to promote scam token
Impact: Chinese-language X account hijacked and scam token promoted
PancakeSwap's Chinese-language X account was hacked and used to promote a fake Sir Pancake token. PancakeSwap confirmed the account hack, and the specific financial losses and recovery measures have not been confirmed.
Related reports: 2 →