Week 41, 2026 security incident report

Personal data of 850,000 Yoido Full Gospel Church members suspected leaked

850KImpact: Suspected leak of personal data, including names and dates of birth, of about 850,000 members

Signs were found that data including the names and dates of birth of about 850,000 members of Yoido Full Gospel Church may have been leaked. After being notified of signs of intrusion by the Korea Internet & Security Agency, the church analyzed access logs and the suspected leaked data with an outside security firm. The church implemented emergency security measures.

Kia union members' personal data leaked in hack of training contractor

20KImpact: Personal data of about 5,000 union members in most tallies; about 20,000 in some

The server of the contractor running the Kia union's online training was hacked, leaking union members' personal information. Most tallies put the number of victims at about 5,000, and the leaked data included employee ID numbers. Some tallies put the figure at about 20,000, so estimates of the scale differed.

Data of 100,000 users of ACRC training site leaked

100KImpact: Personal data of 100,000 Integrity and Rights Learning Center users

The Anti-Corruption and Civil Rights Commission's online training site, the Integrity and Rights Learning Center, was hacked, leaking the personal information of 100,000 users. The Commission said it would act to prevent secondary damage and recurrence of security incidents.

Government24 hack exposes memory dump files from 11 servers

Impact: Memory dump files stolen from 11 servers; an estimated 36 resident registration numbers, three phone numbers, and 55 IDs and passwords exposed

An attack targeting a vulnerable page on Government24’s children’s portal on August 17 resulted in the theft of memory dump files from 11 servers. The Ministry of the Interior and Safety estimated that 36 resident registration numbers, three phone numbers, and 55 IDs and passwords may have been exposed, but could not identify the victims or the precise scope of the leak because the attacker erased traces of the intrusion. The incident notice was hidden after 30 days and deleted following media coverage.

Full Gospel Church hack leaks personal data of 850,000 people

850KImpact: Personal data of 850,000 people

The personal information of 850,000 people was leaked in a hack at Full Gospel Church. The church considered requesting an investigation. SaRang Church also suffered a leak of personal information through hacking.

Hacks of six South Korean academic society websites leak personal data

50KImpact: Estimated 30,000 to 50,000 people affected by personal data leak

Personal data was leaked through hacks of six academic society websites in South Korea. On October 23, the scale of the leak affecting South Korean academic societies and associations was estimated at 30,000 to 50,000 people. The possibility of a hack of an IT service supply chain was raised.

Socar Detects and Blocks Attack After Personal Data of 248 Customers Leaks

248Impact: Personal data of 248 customers

Personal data of 248 Socar customers was leaked. An attack similar to the one used against Musinsa's 29CM was used, and Socar detected and blocked it within 10 minutes, preventing further damage.

Barun Company mobile wedding invitation database illegally accessed and altered

Barun Company, the operator of Barunson M Card, experienced illegal access to and alteration of its database in November 2025. The company confirmed the incident about a year later, on October 7, 2026. Barun Company said it was monitoring the possible exposure of personal information associated with mobile wedding invitations.

Personal data of 1,543 final successful Army civilian employee applicants leaked

1.5KImpact: Personal data of 1,543 final successful civilian employee applicants

The personal information of 1,543 final successful applicants for Army civilian employee positions was leaked. The date of the leak, its cause and the response have not been specified.

Handok customer data on dark web exposes real names, addresses and phone numbers

Impact: Customers' real names, addresses and phone numbers

Handok customer information leaked in 2025 has appeared on the dark web. The exposed information includes real names, addresses and phone numbers; the number of victims and the response have not been specified.

ASOS Customer Data Accessed and Hack Alert Sent Through App

Impact: Customers' personal data including names and contact details; number of people affected unknown

Unauthorized access to customer data occurred at UK fashion retailer ASOS, and an abnormal notification claiming a hack and threatening a data leak was sent to customers' app. ASOS confirmed unauthorized access to customers' names and contact details. It later emerged that the sample obtained by the attacker also included dates of birth and search histories, showing the damage was broader than first disclosed.

Ransomware attack on IDC Frontier affects 495 customers

Impact: 495 corporate and local government customers affected, with registration information for up to 71 customers viewed without authorization

A ransomware attack on the cloud service of IDC Frontier, a subsidiary of Japan's SoftBank, affected 495 corporate and local government customers and encrypted some virtual servers. There was no evidence that data from customers' virtual servers had been exfiltrated, but unauthorized viewing of registration information for up to 71 customers was confirmed. SoftBank's president apologized, and the group expanded its security checks to cover open-source software within the group.

3AM ransomware encrypts 37 systems on UK school network

Impact: Approximately 37 systems encrypted

A UK school network was hit by 3AM ransomware, encrypting approximately 37 systems. The attackers targeted approximately 50 systems accessed from an unmanaged host. Security researchers suggested that the attack may have combined human and artificial intelligence capabilities.

J.B. Hunt faces multiple class actions over alleged data breach

Former employees filed lawsuits over an alleged personal data breach at J.B. Hunt. Multiple class actions followed, and hackers claimed to have obtained records from the transportation company. The timing of the incident and the specific extent of the impact have not been confirmed.

Cyberattack on Osaka Metropolitan University exposes personal information of 170,000 people

170KImpact: Personal information of 170,000 students, faculty, and staff, including bank account numbers, passport images, and other data for approximately 1,400 of them

A cyberattack on Osaka Metropolitan University in October caused system disruptions and class cancellations, and an investigation confirmed that the personal information of 170,000 students, faculty, and staff had been exposed. The exposed data included names and dates of birth, while records for approximately 1,400 people also included bank account numbers and passport images. It emerged that NEC, which managed the system, and its subcontractor had failed to delete the data after the system migration.