Week 12, 2026 security incident report
Hacking and data breach incidents newly reported 2026.03.16 ~ 03.22
From March 16 to 22, the leak of personal data on 290,000 teachers was the largest in South Korea by scale of damage, while the Seoul National University Hospital case, in which a misdirected email leaked the personal and medical information of about 16,000 patients, was the most reported with 12 articles. Controversy over a health information leak at the Gangwon Provincial Office of Education and a hack of a moneylender followed, highlighting damage to sensitive information in education, healthcare and finance, with leaks resulting not only from hacking but also from misdirected email. New incidents in South Korea and abroad totaled 39, with personal data leaks the most common at 18, and chain damage was also confirmed, spreading from Marquis to Infosys Limited and from Orthopaedic Institute of Western Kentucky to CommonSpirit Health. Overseas, cyberattacks disrupted public services and daily life, as ransomware suspended city services in Foster City and a hack of vehicle breathalyzer devices left some vehicles unable to start.
By type
- Data breach17
- Hacking & intrusion13
- Ransomware5
- Phishing & smishing1
Key incidents in South Korea
Misdirected email from Seoul National University Hospital leaks data of about 16,000 patients
16KImpact: Personal and medical information of about 16,000 patients
Due to an email address typing error at Seoul National University Hospital, the personal and medical information of about 16,000 patients was mistakenly sent to an outside party. The leaked information included maternal and newborn medical records and childbirth histories. The hospital requested that the email be deleted and confirmed that it had not been received.
Related reports: 12 · last report →NR Capital Daebu hack leaks customers' personal and credit information
39Impact: Personal and credit information of 39 customers found on the dark web
NR Capital Daebu, a subsidiary of LEADCORP, was hacked, leaking customers' personal and credit information. Information on 39 customers was found on the dark web, including phone numbers, addresses, annual income, credit scores, loan histories, and bank account numbers. The Financial Supervisory Service (FSS) launched an on-site inspection over the personal data leak.
Related reports: 8 · last report →Personal data of 290,000 teachers leaked, appointment letters sent in politician's name
290KImpact: Personal information of 290,000 teachers
Teachers' personal information was leaked from a platform used by elementary school teachers. The leak of personal information of 290,000 teachers and the sending of appointment letters in the name of Kim Moon-soo of the People Power Party came to light. The elementary school teachers' union visited the Anti-Corruption and Civil Rights Commission (ACRC) to protest the leak.
Related reports: 3 · last report →Controversy over leak of health data of 5,200 people at Gangwon education office
5.2KImpact: Health information of 5,200 people
Health information of 5,200 people was leaked from the Gangwon Provincial Office of Education, and allegations arose that the office had covered it up for two years. The office acknowledged that information on about 5,000 people had been leaked but countered that there had been no leak outside the organization.
Related reports: 2 →Hack of small lender leaks resident registration numbers and loan data
Impact: Resident registration numbers, loan information, workplaces, annual salaries and bank account details
A small consumer lender was hit by a hacking attack, leaking personal and loan information. The leaked information included resident registration numbers, workplaces, annual salaries, and bank account details.
Related reports: 2 →Hacking fallout pressures corporate insurance agencies to change business models
Corporate insurance agencies are under pressure to change their business models in the aftermath of hacking. Risks related to insurance databases have grown.
Read on 한국보험신문 ↗KT and SK Telecom brand values diverge after data breaches
The brand values of KT and SK Telecom diverged in connection with personal data breaches. KT's brand value was put at 5.86 trillion won and SK Telecom's at 3.91 trillion won.
Read on 더구루 ↗New scam involving Coupang cross-border purchase deliveries
Mysterious cross-border purchases were delivered via Coupang, raising concerns about further leaks of personal information. The cases were described as a new type of scam.
Read on 연합뉴스TV ↗
Supply-chain breaches
Western Kentucky Orthopaedic Institute exposes Social Security numbers
Impact: Social Security numbers exposed
A data breach at Western Kentucky Orthopaedic Institute exposed Social Security numbers. The number of people affected and the date of the incident have not been confirmed.
Related reports: 2 · last report →
Sensitive data leaked from anonymous crime and school tip systems
Impact: Sensitive student information and other data; 93GB of tip data according to the hackers' claims
It came to light that sensitive student information and other data from anonymous crime and school tip systems had fallen into the hands of hackers. The hackers claimed to have hacked 93GB of anonymous crime tip data. The Portland Police Bureau advised the use of alternative tip channels, and US senators demanded answers about the data leak from school tip systems.
Related reports: 4 · last report →
Key incidents in other countries
Ransomware attack shuts down city services in Foster City
Impact: Multiple city services shut down and city computer systems offline for several days
Foster City in the U.S. was hit by a ransomware attack that shut down multiple city services and left city computer systems offline for several days. The city declared a state of emergency over the attack.
Related reports: 11 · last report →Hack of U.S. vehicle breathalyzer device maker leaves cars unable to start
Impact: Devices in 45 U.S. states affected; some vehicles unable to start
A vehicle breathalyzer device maker in Iowa was hit by a cyberattack, affecting devices in 45 states. Some drivers were unable to start their vehicles, and service shops were also affected. In Oklahoma City, cases emerged of residents facing financial hardship due to the hack.
Related reports: 7 · last report →Aura voice phishing exposes about 900,000 marketing contacts
900KImpact: About 900,000 marketing contacts including names and email addresses
At security firm Aura, an employee account was taken over for about an hour through voice phishing, and about 900,000 marketing contacts were stolen. The stolen data included names and email addresses. The company confirmed the breach and said Social Security numbers, passwords and financial information were not compromised.
Related reports: 3 · last report →Intoxalock cyberattack disrupts breathalyzer device services
Impact: Calibration services for breathalyzer ignition interlock devices halted and some customers unable to use them
Iowa-based Intoxalock was hit by a cyberattack that disrupted calibration services for its breathalyzer ignition interlock devices. Some Iowa customers were affected, and the systems were later brought back online.
Related reports: 3 · last report →Navia Benefit Solutions leaks personal data of 2.7 million people
2.7MImpact: Personal information of about 2.7 million people
The personal information of about 2.7 million people was leaked from Navia Benefit Solutions, a U.S. benefits administration company. The attacker accessed the systems between December 2025 and January 2026, obtaining names, dates of birth, Social Security numbers, contact details, and benefits enrollment information. The company sent notifications of the data breach.
Related reports: 2 →