Week 2, 2026 security incident report
Hacking and data breach incidents newly reported 2026.01.05 ~ 01.11
From January 5 to 11, 2026, the most prominent development in South Korea was evidence of hacking damage at a total of 25 organizations, companies and websites, including universities, hospitals and online shopping malls, showing a pattern of breaches spanning multiple industries. At Chungbuk National University's College of Veterinary Medicine, the leak of some website posts, such as the academic calendar, and signs of their sale on the dark web were confirmed, and turmoil in the telecom market caused by the waiver of early termination fees after a hacking incident also continued. New incidents totaled three in South Korea and 34 overseas, with personal data leaks (15) and hacking/intrusion (14) making up the majority by type. Overseas, allegations of a data leak affecting about 17.5 million Instagram accounts and controversy over password reset emails, as well as the hijacking of Bruno Fernandes's X account, drew attention, while UK schools faced closures and class disruptions due to ransomware and cyberattacks.
By type
- Data breach15
- Hacking & intrusion14
- Ransomware7
- Malware1
Key incidents in South Korea
Signs of hacking at 25 South Korean universities, hospitals and online stores
Impact: A total of 25 South Korean institutions, companies and websites targeted
The government and the Korea Internet & Security Agency (KISA) found signs that internal data from South Korean medical and educational institutions, online shopping malls and others had been stolen and was being sold on hacking forums. Signs of damage identified from December 2025 to January 5, 2026, were shared, and the leaked data included dormitory outing records and plastic surgery clinic information. On January 13, it was reported that further attacks by the hacker AshleyWood2022 had brought the total number of targets to 25.
Related reports: 6 · last report →Data from hack of Chungbuk National University vet school website apparently traded on dark web
Impact: Leak of some posts, such as the academic calendar, from the College of Veterinary Medicine website
The website of Chungbuk National University's College of Veterinary Medicine was hacked, and signs emerged that the leaked data was being traded on the dark web. The university said some posts, such as the academic calendar, were leaked, but no sensitive information such as student names or mobile phone numbers was included.
Read on 뉴스1 ↗Termination fee waiver after hacking incident throws telecom market into turmoil
Early termination fees were waived following a hacking incident. This caused turmoil in the telecom market.
Read on 디일렉 ↗
Key incidents in other countries
Bruno Fernandes' X account hacked to post criticism
Impact: Bruno Fernandes' X account hijacked and unauthorized posts published
After Manchester United's FA Cup exit, captain Bruno Fernandes' X account was hacked. Posts criticizing co-owner INEOS appeared on the account. The club announced the account had been hacked and asked fans not to interact with it.
Related reports: 10 · last report →Allegations of data leak affecting 17.5 million Instagram accounts
17.5MImpact: Alleged data leak affecting about 17.5 million accounts
In January 2026, allegations surfaced that data from about 17.5 million Instagram user accounts had been leaked and was circulating on the dark web. A security firm claimed personal data had been leaked, but Instagram denied the leak reports and said its service was secure.
Related reports: 7 · last report →Instagram password reset email controversy and leak allegations
Concerns grew as users received password reset emails amid allegations that data from 17.5 million Instagram accounts had been leaked. Instagram denied any data breach and fixed a password reset vulnerability.
Related reports: 7 · last report →Warwickshire high school in UK closes after ransomware attack
Impact: IT system failures, school closure and class cancellations
A high school in Warwickshire, UK, closed after a cyberattack caused failures in its IT systems. Classes were canceled and the reopening schedule was delayed, after which plans to reopen the school were announced. The attack was identified as ransomware, but the school's name and specific recovery measures have not been confirmed.
Related reports: 4 · last report →UK's Higham Lane School closed for about two weeks after cyberattack
Impact: In-person classes suspended for about two weeks and failures of communications, management and safety systems
Higham Lane School in the UK suspended attendance for students and staff due to a cyberattack. The closure was extended because phones, email, the school management system, electronic doors and fire alarms were not working. The school resumed in-person classes, which had been suspended for about two weeks.
Related reports: 4 · last report →