Week 50, 2025 security incident report
Hacking and data breach incidents newly reported 2025.12.08 ~ 12.14
From December 8 to 14, 2025, there were three new incidents in South Korea, with Qilin's claim to have hacked Nepes and allegations of a ransomware infection, covered in four articles, drawing the most attention. In the hack of Chungjeon Dwaeji's PiggyCell, about 20 million tokens were issued and sold without authorization, and a leak at an AI calling app also occurred, revealing information protection problems in both crypto assets and calling services. Incident types overall centered on personal data leaks (28) and hacking/intrusion (20), with ransomware also accounting for 9. Overseas, of 58 new incidents, the leak of Pornhub Premium members' activity data and threats to publish it drew attention with 11 articles, and data leaks including health information and chain-reaction damage from Mercyhealth to Benefis Health System were also confirmed.
By type
- Data breach28
- Hacking & intrusion19
- Ransomware9
- Malware2
- Phishing & smishing2
Key incidents in South Korea
Qilin claims hack of Nepes amid ransomware infection suspicions
Ransomware group Qilin claimed to have hacked chipmaker Nepes. Signs of a ransomware infection at Nepes and allegations of damage subsequently emerged. Controversy also continued over whether Nepes's denial regarding ransomware was false.
Related reports: 4 · last report →PiggyCell hack: about 20 million tokens minted and sold without authorization
Impact: About 20 million tokens minted and sold without authorization
On December 5, 2025, PiggyCell, a blockchain project of Chungjeon Dwaeji, was hacked. The attacker used an exposed private key to abuse the smart contract's minting function, minting and selling about 20 million tokens without authorization.
Read on 뉴스웨이 ↗AI calling app leak raises data protection concerns
A leak occurred at an AI calling app. The incident raised concerns about protecting the information held by artificial intelligence; the app's name, the scale of the damage, the timing and the response have not been confirmed.
Read on 시사저널 ↗
Supply-chain breaches
Third-party vendor breach exposes MercyOne patient data
Impact: Patients' personal and medical information
A breach at a MercyOne third-party vendor exposed patients' personal and medical information. MercyOne patients were notified of the incident.
Read on KCCI ↗
Key incidents in other countries
Pornhub Premium members' activity data leaked, with threats to publish it
Impact: Premium members' activity data, viewing habits and search histories
Activity data of Pornhub Premium members was stolen and used to threaten its disclosure. The leak was linked to the Mixpanel breach, and viewing habits and search histories were reportedly exposed. The hacking group ShinyHunters threatened to publish member information.
Related reports: 12 · last report →Germany blames Russia for cyberattack on air traffic control
A cyberattack targeted German air traffic control. The German government blamed Russia for the attack as well as for election interference and disinformation, and summoned the Russian ambassador. The specific extent of the damage and the attack method have not been confirmed.
Related reports: 8 →Fieldtex Products data breach affects 238,000 people
238KImpact: Data on 238,000 people, including health information
A data breach affecting 238,000 people occurred at Fieldtex Products, and the leaked information included health data. The possibility of lawsuits over the breach was raised, but the date of the incident and the specific response have not been confirmed.
Related reports: 5 · last report →MedStar Health breach exposes personal and health data of 64,000 people
64KImpact: Personal information and protected health information of 64,000 people
Sensitive personal information and protected health information of 64,000 people was leaked at MedStar Health. MedStar Health notified affected patients of the data theft. The date of the incident and the specific intrusion route have not been confirmed.
Related reports: 5 · last report →Rockrose Development breach exposes data of 47,000 people
47KImpact: Personal information, including Social Security numbers, of about 47,000 people
A security breach at Rockrose Development affected about 47,000 people. The leaked information included Social Security numbers. When the incident occurred, the specific breach method and the response are not known.
Related reports: 4 · last report →