Week 45, 2025 security incident report
Hacking and data breach incidents newly reported 2025.11.03 ~ 11.09
In South Korea, the takeover of smartphones, PCs and KakaoTalk accounts by a North Korean hacking group received the most coverage, and together with the compromise of Galaxy devices by the LANDFALL spyware exploiting a zero-day, attacks targeting personal devices and messengers stood out. In the hacking revealed by Phrack, shortcomings in asset identification and attack surface management were pointed out, and allegations of a personal data leak and controversy over data management arose at the SH Urban Research Institute. Of 55 new incidents in total, personal data leaks were the most common at 32, followed by hacking/intrusion (13) and ransomware (6). Overseas, a breach of the US Congressional Budget Office's systems received the most coverage, and personal data leaks, including 2.7 million Social Security numbers at Hyundai AutoEver America, and exposures of information on employees, contractors and partners at The Washington Post and Nikkei stood out.
By type
- Data breach29
- Hacking & intrusion13
- Ransomware6
- Malware2
- DDoS1
- Phishing & smishing1
Key incidents in South Korea
North Korean hackers take over smartphones, PCs and KakaoTalk in South Korea
Impact: Compromise of smartphones, PCs and KakaoTalk of users in South Korea
A North Korean hacking group carried out attacks that accessed and took control of smartphones, PCs and KakaoTalk accounts in South Korea. Damage was uncovered in which smartphone compromises also led to compromises of home PCs.
Related reports: 3 · last report →LANDFALL spyware exploits zero-day to compromise Galaxy phones
Impact: Information including photos on Galaxy phones
The LANDFALL spyware exploited a zero-day vulnerability to hack Samsung Galaxy phones. The compromise lasted 10 months, and information including photos was shared externally.
Related reports: 2 · last report →Poor asset identification and attack surface management blamed for Phrack-revealed hack
Inadequate asset identification and attack surface management (ASM) were cited as the cause of the hack revealed by Phrack. The affected organizations and the specific scale of the damage have not been confirmed.
Read on 지디넷코리아 ↗SH Urban Research Institute faces data leak allegations and data management controversy
Allegations of a personal data leak spread at SH Urban Research Institute. The management of research data became a point of contention.
Read on 뉴스프리존 ↗
Key incidents in other countries
Hack compromises systems at the US Congressional Budget Office
The US Congressional Budget Office was hacked and investigated a breach of its systems. The possibility of an attack by a foreign actor and suspicions of Chinese involvement were raised, and the CBO introduced new security measures.
Related reports: 12 · last report →Hyundai AutoEver America leaks Social Security numbers and more
2.7MImpact: Personal information including 2.7 million Social Security numbers and driver's license information
A personal data leak at Hyundai AutoEver America exposed Social Security numbers and driver's license information. Owners of Hyundai, Kia and Genesis vehicles were cited as affected, and the leak was put at 2.7 million Social Security numbers. An investigation toward a class action was subsequently launched in the US.
Related reports: 11 · last report →Nikkei Slack intrusion may have exposed data of over 17,000 people
17.4KImpact: Possible leak of names, email addresses and conversation logs of 17,368 employees and business partners
Nikkei Inc. said an unauthorized login to its internal messaging platform Slack had occurred. The cause was the leak of Slack credentials due to a malware infection on an employee's personal PC. Names, email addresses and conversation logs of 17,368 employees and business partners may have been leaked.
Related reports: 5 · last report →Hack of Washington Post's Oracle environment leaks data of about 10,000 people
10KImpact: Personal data, including Social Security numbers, of about 10,000 employees, contractors and others
The Washington Post's Oracle environment was hacked, and the information of about 10,000 people, including employees and contractors, was stolen. The Washington Post confirmed the data breach in November 2025. The leaked information included Social Security numbers.
Related reports: 5 · last report →DeFi protocol hit by hack worth over $100 million
Impact: Crypto assets worth over $100 million
A decentralized finance protocol suffered a hack worth over $100 million. The price of Ethereum fell 7% after the incident.
Related reports: 2 · last report →