Week 8, 2026 security incident report
Hacking and data breach incidents newly reported 2026.02.16 ~ 02.22
From February 16 to 22, 2026, three new incidents were recorded in South Korea, the most prominent being the hacking and deletion of Han Hye-jin's YouTube channel, which had 860,000 subscribers. A personal data leak also occurred in connection with a whistleblower complaint over the illegal distribution of milk by a major company, and the Gwangju District Prosecutors' Office was confirmed to have recovered all of the roughly 320 seized bitcoins that had been stolen from it through phishing. Across all incident types in South Korea and abroad, personal data leaks were the most common at 32, followed by ransomware at 12. Overseas, a ransomware attack on the University of Mississippi Medical Center shut its outpatient clinics for nine days, with losses mounting from canceled surgeries and tests and lower revenue, while long-term exposure of PayPal user information and the theft of personal data from Advantest were also reported.
By type
- Data breach32
- Ransomware12
- Hacking & intrusion5
- Phishing & smishing2
Key incidents in South Korea
Han Hye-jin's YouTube channel with 860,000 subscribers deleted after hack
860KImpact: Deletion of a YouTube channel with 860,000 subscribers
Han Hye-jin's YouTube channel, which had 860,000 subscribers, was deleted after a hack linked to a cryptocurrency scam. Han expressed her dismay and distress over the channel's deletion.
Related reports: 4 · last report →Personal data leaked in connection with report on illegal distribution of major company's milk
Personal information was leaked in connection with a report of illegal distribution of a major company's milk. The affected parties, the scale of the leak, the timing and response measures have not been confirmed.
Read on Daum ↗Gwangju prosecutors recover all of about 320 bitcoins stolen in phishing
Impact: About 320 seized bitcoins stolen, then fully recovered
About 320 seized bitcoins were stolen after a prosecution official entered wallet information on a phishing site. The Gwangju District Prosecutors' Office had exchanges freeze the assets and pursued a tracking investigation. On February 17, 2026, it recovered all of the bitcoins returned by the perpetrator.
Read on ZDNet Korea ↗
Key incidents in other countries
Ransomware Attack Halts Outpatient Care at University of Mississippi Medical Center
Impact: Outpatient clinics closed for nine days, surgeries, procedures and tests canceled, and a 20% drop in revenue
The University of Mississippi Medical Center was hit by a ransomware attack in February 2026, disrupting access to its electronic medical records and key IT systems. Outpatient clinics statewide were closed and appointments for surgeries, procedures and tests were canceled, while inpatient care and the emergency department operated with emergency procedures and paper records. The medical center resumed clinic operations after nine days and later said it had not paid a ransom.
Related reports: 33 · last report →PayPal loan system error exposes user data for six months
Impact: Exposure of users' personal information and Social Security numbers, and some unauthorized transactions
A code error in PayPal's loan application exposed users' personal information and Social Security numbers for six months. Some accounts saw unauthorized transactions and financial losses. PayPal disclosed the breach and reset passwords.
Related reports: 15 · last report →Advantest ransomware attack leads to personal data theft
Impact: Theft of personal data; internal IT systems affected
Advantest, a Japanese semiconductor test equipment maker, suffered a ransomware attack in February 2026 that affected its internal IT systems. The company investigated whether customer and employee information was affected, and in October of the same year confirmed that personal data had been stolen.
Related reports: 10 · last report →Lazarus targets US healthcare organizations with Medusa ransomware
North Korean hacking group Lazarus used Medusa ransomware to attack US healthcare organizations and targets in the Middle East, among others. The targets also included nonprofit organizations, and the ransomware was used for extortion.
Related reports: 7 · last report →Canada Goose investigates leak of customer transaction data
600KImpact: Claimed leak of about 600,000 customer records
Canada Goose customer transaction data was leaked, and hackers claimed to have obtained about 600,000 records. While investigating, Canada Goose said the leaked data did not come from its own systems. Researchers said the data was several years old.
Related reports: 5 · last report →