Week 44, 2025 security incident report

Lost storage media at child rights agency leaks 1.17 million personal records

1.2MImpact: More than 1.17 million records of personal information on adoptees and missing children

The National Center for the Rights of the Child lost storage media, including CDs and external hard drives containing personal information of adoptees and missing children, leaking more than 1.17 million records. An external hard drive holding the results of a project to digitize missing-child information was lost and then re-obtained from a contractor in 2024, and it was also found that the contractor had held the personal data for more than four years after the project ended. The Personal Information Protection Commission (PIPC) released its findings on poor storage media management and other failings and imposed fines and penalties totaling 885.2 million won.

Qilin ransomware gang claims hack of KT affiliate AltiMedia

The Qilin ransomware gang claimed to have hacked KT affiliate AltiMedia and set an 83-hour countdown until the data would be released. AltiMedia reported the incident to the Korea Internet & Security Agency (KISA).

Ransomware knocks out ticket machines at Seoul Nambu Terminal

Impact: Ticket machines stopped working

Ticket machines at Seoul Nambu Terminal were infected with ransomware and stopped working. T-money said it was investigating the incident. Criticism later arose that passengers had not been adequately informed of the attack on the ticketing system.

Government IT service exposes resident registration numbers via license plate numbers

Impact: Exposure of resident registration numbers

A problem was revealed in a service under a flagship project of the Yoon Suk Yeol administration whereby entering only a vehicle license plate number exposed resident registration numbers. Concerns were also raised that government IT services are vulnerable to parameter-tampering attacks.

Gang arrested for stealing massage parlor customer data and extorting 500 million won

Impact: Theft of massage parlor customer information and extortion of 500 million won

A gang installed a hacking app to steal customer information from massage parlors. They extorted 500 million won by threatening to tell customers' spouses about their visits. The gang members involved in the crime were arrested.

Case study released on response to hack of game company via security software

A case of hackers infiltrating a game company through a security solution was made public. The incident was presented as an example of best-practice response, but the affected game company, the scale of the damage and the specific response measures have not been confirmed.

KakaoTalk rollback developer halts patch after DDoS attack

Impact: KakaoTalk rollback patch halted

A developer who succeeded in rolling back KakaoTalk said they had halted their patch due to a DDoS attack. The timing of the attack, the specific scale of the damage and any further response have not been confirmed.

Privacy controversy over complaint about Gwangju Nam-gu council member Hwang Kyung-a's book launch banner

A personal data leak controversy arose over a complaint concerning a banner for a book launch event held by Hwang Kyung-a, a member of the Nam-gu District Council in Gwangju. Whether a leak occurred, the scale of the damage and the response measures have not been confirmed.

Incheon also hit in hacking attack on South Korean government administrative network

Incheon Metropolitan City was also affected by a hacking attack on the government administrative network. The exact date of the incident, the extent of the damage, the attack method and the response have not been confirmed.

2005 internet banking hack led to OTP and dedicated security teams

An internet banking hacking incident occurred in 2005. The incident led to the introduction of OTPs and dedicated security organizations, while the affected institutions, the scale of the damage and the exact date of occurrence are not confirmed.

University of Pennsylvania account takeover leaks alumni and donor data

1.2MImpact: Leak of alumni- and donation-related data; attackers claim 1.2 million donor records

In October 2025, a University of Pennsylvania employee account was hijacked through a social engineering attack, compromising alumni- and donation-related systems and data. The attackers sent mass offensive emails from the account and claimed to have stolen 1.2 million donor records. The university said it reported the incident to the FBI, contained the breach and completed its investigation in February 2026. The attackers later released additional internal documents.

Infostealer leak data includes Gmail account passwords

183MImpact: Gmail passwords included in leak data covering 183 million accounts

It was reported that infostealer leak data covering 183 million accounts included Gmail passwords. Google denied claims that interpreted this as a massive breach of Gmail itself. Google recommended changing exposed passwords and using passkeys.

US security professionals took part in BlackCat ransomware attacks

People working in ransomware response and negotiation in the US used ALPHV/BlackCat to carry out ransomware attacks against US organizations. The US Department of Justice and prosecutors brought charges against them over their involvement in the attacks in November 2025. Two security professionals later pleaded guilty to taking part in the attacks.

Hack at Dentsu's US subsidiary Merkle exposes employee and client data

Impact: Employee and client data

Merkle, the US subsidiary of Dentsu, was hit by a cyberattack and had data stolen. Employee and client data were exposed, and Dentsu announced the data breach. The date of the incident, the specific scale of the damage and the response measures have not been confirmed.

Ernst & Young cloud migration error exposes 4TB backup

Impact: Database of about 4TB containing company secrets

A cloud migration error at Ernst & Young left a database of about 4TB publicly exposed online. The exposed data was a SQL Server backup stored on Microsoft Azure and contained company secrets.