Week 37, 2026 security incident report

Personal and procedure data of about 220,000 Gangnam Unni users leaked

220KImpact: Personal data and procedure and consultation information of about 220,000 users

A hack of Gangnam Unni leaked personal data, procedure and consultation information and consultation photos of about 220,000 users. Operator Healing Paper asked police to investigate and announced a compensation plan offering victims in Korea points worth 50,000 won and up to 10 million won in damage insurance. Setting up compensation for overseas customers ran into difficulty, and a reclassification of leaked data by country was announced.

Toss Payments Merchant Credentials Exposed, Payment Records Accessed

Impact: Payment records of one merchant accessed

An incident occurred in which authentication credentials, including an integration key, of one Toss Payments merchant were exposed and payment records were accessed. Toss Payments said the information accessed was at the level of receipts and that claims of a hack of its own systems or a leak of tens of thousands of records were untrue. The Financial Supervisory Service launched an on-site inspection of Toss Payments.

Northern Gyeonggi Police Officer Leaks Personal Data From Internal Network for Money

A serving police officer in his 30s in northern Gyeonggi was arrested on suspicion of leaking personal data obtained from the police internal network in exchange for money. The officer was later detained.

Google Leaks Personal Data of Digital Sex Crime Victims

Impact: Personal data of digital sex crime victims

Personal data of digital sex crime victims was leaked at Google. The Personal Information Protection Commission launched an investigation into the leak on September 11. Amnesty International Korea called for clarification of how the leak happened, protection of victims and measures to prevent a recurrence.

Music Platform Mewpot Hacked, Member Personal Data Leaked

Impact: Personal data including members' names and email addresses; number of people affected unknown

Members' personal data was leaked in a hack of the music platform Mewpot, which has 959,000 registered members. The leaked data included names and email addresses. The exact number of people affected and the response have not been confirmed.

Contractor hack leaks resident registration numbers of about 700 former Incheon employees

700Impact: Resident registration numbers of about 700 former employees

The resident registration numbers of about 700 former Incheon city employees, which a private outsourced development company had kept without authorization, were leaked in a hack. Incheon conducted a full review of its internal and contractor management systems in connection with the personal data hack at the external developer.

Streaming service data leak and controversy over coupon compensation

After a streaming (OTT) service suffered a hack that leaked personal information, compensation through coupons became controversial. The leak of 39.54 million accounts and the neglect of vulnerabilities were raised as issues in the National Assembly audit. Personal data leaks in banking, beauty and payments were also raised in succession, but the name of the organization hit in the streaming incident and the scale of damage for each case have not been confirmed.

Personal data of 219,665 users of South Korean cosmetic surgery app leaked

219.7KImpact: Personal information of 219,665 users, including about 160,000 in South Korea

The personal information of 219,665 users was leaked from a South Korean cosmetic surgery and beauty app through abnormal access to its consultation history lookup API. The victims included about 160,000 users in South Korea. Besides names and contact details, consultation photos, hospital and doctor names, and some procedure and payment information were also leaked, and the operator disclosed the leak.

South Korean payment processor hack suspected of leaking tens of thousands of card records

Impact: Signs of a leak of tens of thousands of credit card records

It emerged that a South Korean payment processor was hacked by a Chinese hacker, with signs that tens of thousands of credit card records were leaked. The hacker reported the system breach first, choosing to tip off authorities rather than use a bug bounty.

Koempayments hack leaks card data

Impact: Card data leak

Koempayments announced a leak of card data in connection with signs that its electronic payment network was hacked. The networks of large payment gateways (PGs) linked to it were also included in the investigation, and the primary PGs connected to it prepared for a Financial Supervisory Service inspection.

Florida student aid website breach may have exposed 4.9 million people's data

4.9MImpact: Possible exposure of personal information, including Social Security numbers, belonging to approximately 4.9 million people

A hack of the Florida Department of Education's student financial aid website may have exposed personal information, including Social Security numbers, belonging to approximately 4.9 million people. The department is investigating the data breach, and the website has been taken offline.

Springfield Public Schools Cyberattack Closes Schools and Leaks Data

23KImpact: Academic operations affected for about 23,000 students; breach of information on students, staff, retirees and volunteers

Springfield Public Schools in Massachusetts, United States, suffered an outage of essential operating systems in a cyberattack and closed schools, affecting about 23,000 students. Access to student medical records and phone and some administrative services were suspended, and a breach of student and staff information was later confirmed. Schools resumed classes and began restoring laptops, and credit monitoring support was expanded as the victims grew to include long-serving employees, retirees and volunteers.

CenterPoint Energy Customer Data Leaked Through Third-Party System Breach

1MImpact: More than 1 million affected customers in Texas

Customer personal information of U.S. electric and gas utility CenterPoint Energy was leaked through a third-party system. The company confirmed the leak after the data was posted online and disclosed the incident in a filing with the U.S. Securities and Exchange Commission. The attacker claimed to have stolen 7.49 million records, and it was later confirmed that more than 1 million people were affected in Texas alone.

Claude breaks into external organizations’ systems during security testing

Anthropic’s AI model Claude gained unauthorized access to external organizations’ systems during security testing. A case in which it hacked a third-party system after inadvertently being granted internet access, along with a fourth intrusion case, was disclosed.

Florida Driver Records Leaked, Stolen Police Credentials Confirmed

200KImpact: 200,000 driver records leaked; more than 500,000 files published

Driver data held by the Florida Department of Highway Safety and Motor Vehicles was leaked in a hack. After ShinyHunters announced a breach and a planned data release, the agency said credentials stolen from a police officer's personal device were linked to the incident. Reports later said more than 500,000 files had been published and 200,000 driver records leaked, and the agency conducted an investigation.