Week 46, 2025 security incident report

Han Hye-jin's YouTube channel hacked to stream crypto broadcasts

860KImpact: Deletion of a YouTube channel with about 860,000 subscribers and unauthorized broadcasts

The YouTube channel of model Han Hye-jin, which has about 860,000 subscribers, was hacked, used to stream crypto-related broadcasts and then deleted. Han Hye-jin's side filed an appeal and took steps to restore it. The channel was later fully restored.

HR data of 5,000 Samsung Biologics employees leaked internally

5KImpact: Personal information of about 5,000 employees, including salaries, educational backgrounds and performance evaluations

Personal information of about 5,000 Samsung Biologics employees, including salaries, educational backgrounds and performance evaluations, was leaked on the company's internal network. Controversy also followed over a leak of psychological counseling information, and the company said there had been no external leak. CEO John Rim apologized and pledged to prepare countermeasures and work to prevent further damage, while the labor union filed a complaint against company executives.

Former Kakao executive Bae Jae-hyun claims brokerage account was hacked

Impact: Losses of 11 billion won claimed by Bae Jae-hyun

Bae Jae-hyun, Kakao's former chief investment officer, claimed he lost 11 billion won when his Mirae Asset Securities account was hacked. Bae has filed a civil lawsuit seeking damages from Mirae Asset Securities.

Ransomware attack paralyzes K2 Korea's network

Impact: Network paralysis and disruption of store operations

K2 Korea was hit by a ransomware attack that paralyzed its computer network. The network outage disrupted store operations. The specific date of the incident and response measures have not been confirmed.

Data of 5,000 employees leaked as questions raised over union laptop

5KImpact: Data of 5,000 employees

Data of 5,000 employees was leaked. Questions have been raised regarding a union laptop, but the specific connection between the affected organization and the laptop and the response have not been confirmed.

Series of hacks at three major carriers raises concerns over security ecosystem

A string of hacking incidents at South Korea's three major telecom carriers raised concerns about the safety of the security ecosystem. The dates, scale of damage and responses for the individual incidents have not been confirmed.

Police accessed personal data without authorization and leaked sex crime victims' information

Impact: Leak of sex crime victims' information

The Board of Audit and Inspection (BAI) flagged unauthorized access to personal data by police and leaks of sex crime victims' information. The scale of the damage, the timing and follow-up measures have not been confirmed.

Telecom carrier's encryption breached amid malware cover-up controversy

A telecom carrier's encryption technology was breached, and controversy arose over an alleged cover-up of a malware infection. The carrier's name, the scale of the damage, the timing and the response have not been confirmed.

K2 Korea Group network paralyzed amid signs of ransomware attack

Impact: Network paralysis

K2 Korea Group's computer network was paralyzed, and signs of a ransomware attack emerged. Concerns have been raised about a leak of customer data, but whether a leak actually occurred, the scale of the damage and the response have not been confirmed.

Police open preliminary probe into ransomware attack on Hanmaeum Blood Center

Police opened a preliminary investigation after Hanmaeum Blood Center was hit by a ransomware attack. Whether any data was leaked is being checked, and the date of the incident and the scale of the damage have not been confirmed.

Chinese hacking group abuses Claude to attack organizations worldwide

Impact: About 30 targets, including tech companies and government agencies worldwide

Anthropic said a Chinese state-sponsored hacking group abused Claude to automate cyberattacks against multiple organizations around the world. The targets included tech companies and government agencies, and Anthropic said it had blocked the attack activity. Questions were also raised about the level of automation in the attacks.

DoorDash personal data leaked after social engineering attack on employee

Impact: Contact details and personal information of customers, delivery workers and others leaked

At US delivery service DoorDash, a social engineering attack targeting an employee led to the theft of personal information of customers and delivery workers. The leaked information included contact details, and the company notified affected users of the breach. A lawsuit related to the data breach was subsequently filed.

Princeton University phishing incident exposes alumni and donor data

Impact: Names, email addresses, phone numbers and addresses of alumni, donors, students, faculty and staff and others exposed

On November 10, 2025, phishing targeting an employee at Princeton University led to a breach of its advancement and alumni database. Names, email addresses, phone numbers and addresses of alumni, donors, students, faculty and staff and others were exposed. The university disclosed the breach, and a class action lawsuit alleging a failure to protect personal information was subsequently filed.

Mount Baker Imaging data breach from ransomware

Mount Baker Imaging suffered a data breach from a cyberattack in 2025. A lawsuit was filed over the delayed breach notification, and the company pursued a settlement of the ransomware-related litigation. In June 2026, it began the settlement process.

Edtech company hack exposes data of 3 million students

3MImpact: Data of 3 million students

An education technology company was hacked, exposing the data of 3 million students. The company agreed to a $5.1 million settlement with the attorneys general of three US states over the student data breach.