Week 43, 2026 security incident report
Hacking and data breach incidents newly reported 2026.10.19 ~ 10.25
New cybersecurity incidents from October 19 to 25, 2026, numbered 20 in South Korea and 83 overseas, with personal data leaks the most common type at 57, followed by ransomware at 25 and hacking/intrusions at 19. In South Korea, the Bithumb hack, which leaked information on 6,444 customers and 715 employees and contractor staff, drew the most attention with 131 articles, and about 100 million won was also stolen from Pravang, highlighting damage at crypto exchanges. Personal data leaks also continued in education and retail, including at Yonsei University, Pukyong National University and Giftiel, while chain damage to Korean Air and Asiana Airlines from a hack of an aviation contractor and the possible leak of client data from a breach of a Douzone Bizon backup server emerged. Overseas, large-scale damage was reported, including the leak of about 11.77 million Capcom ID accounts and an impact on up to 26,739 GMO Internet cloud servers.
By type
- Data breach48
- Ransomware20
- Hacking & intrusion19
- Malware1
- DDoS1
Key incidents in South Korea
Bithumb groupware hack exposes data of 1,559 customers and staff
1.6KImpact: Personal data of 1,559 people exposed, including 844 customers and 715 employees and partner company staff
Bithumb announced a breach of its internal mobile system and a personal data leak on October 28. Files containing information on 6,444 customers and 715 employees and partner company staff were exfiltrated through an intrusion into Daou Office, but data on 5,600 customers was encrypted, bringing the confirmed number of people whose personal data was exposed to 1,559, including 844 customers. Some customers' resident registration numbers, bank account numbers and copies of identification documents were exposed, and Bithumb's CEO apologized and pledged assistance and compensation for those affected.
Related reports: 148 · last report →Pravang hack steals about 100 million won and exposes seven users' data
7Impact: Approximately 100 million won in crypto assets stolen and seven users' personal and credit information exposed
A hack at cryptocurrency exchange Pravang resulted in the theft of approximately 100 million won in crypto assets. The investigation also confirmed the exposure of seven users' personal and credit information, including login passwords, OTP keys, asset balances, and personal wallet addresses. Pravang temporarily suspended its services and pledged to fully compensate customers for their losses.
Related reports: 81 · last report →Yonsei University portal hack leaks personal data of about 15,000 people
15KImpact: Personal data of about 15,000 people, including current students, alumni and staff
Yonsei University's portal service was hacked, leaking the personal data of about 15,000 people, including current students, alumni and staff. The leaked data included student ID numbers, contact details, email addresses and login IP addresses. The university requested an investigation, and police opened a preliminary inquiry.
Related reports: 39 · last report →Lotte Affiliate Giftiel Hacked, Customer Personal Data Leaked
18.4KImpact: Personal data of 18,359 customers
Giftiel, a Lotte Group affiliate that issues mobile coupons, was hacked, leaking personal data such as the names, phone numbers and refund account numbers of customers who had applied for refunds. The number of victims was confirmed at 18,359. The operator suspended the service for security fixes and said it aims to restore it on November 4 and will extend the validity of unused coupons by 30 days.
Related reports: 16 · last report →PayHub hack diverts about 200 million won in merchant settlement funds
Impact: About 200 million won in merchant settlement funds fraudulently transferred
About 200 million won in merchant settlement funds was fraudulently transferred in a hack at payment gateway provider PayHub. The company discovered the loss during an internal check for access from IP addresses linked to financial-sector hacking. Exploitation of a vulnerability in the payment and transfer request API is suspected, while the Financial Supervisory Service (FSS) has extended its on-site inspection and the Financial Security Institute (FSI) is investigating the incident.
Related reports: 10 · last report →Pukyong National University Tuition System Hack Leaks Data of 5,108 People
5.1KImpact: Personal data of 5,108 people, including 5,106 students and 2 staff members
The contractor for Suhyup Bank's Campus e-Moa system, used for tuition payments at Pukyong National University, was attacked, leaking the personal data of 5,106 students and 2 staff members. The attacker created an unauthorized administrator account to access the database. The university became aware of the incident when the attacker demanded money using the stolen data.
Related reports: 7 · last report →NOL Universe Hack Leaks Personal Data of Customers and Current and Former Employees
Impact: Personal data of customers and current and former employees
NOL Universe was hit by an external attack that leaked the personal data of customers and employees. Those affected include Interpark Tour bookers and an employee who left eight years ago. The company announced the leak on its website on October 22, and on the 26th apologized and said it would strengthen its security systems.
Related reports: 7 · last report →Remember system glitch exposes some members' business card data
Impact: Business card information of some members
In mid-October 2026, a system glitch at Remember exposed some members' business card information in other users' card folders. The Personal Information Protection Commission launched an investigation. As of October 31, clarifying the cause and responsibility and drawing up an organizational overhaul plan had been delayed.
Related reports: 6 · last report →Korea Foundation email systems hacked, signs of further data leaks found
The Korea Foundation’s bulk email system was targeted by an external attack exploiting a vulnerability on July 29, and the foundation confirmed the breach on October 19. On November 4, signs of additional personal data leaks were also found in its regular email system and elsewhere. The foundation is investigating with relevant authorities what data was actually leaked and the extent of the leak, including email addresses, names, affiliations, phone numbers, and addresses.
Related reports: 5 · last report →Hanjin Information Systems & Telecommunication ITSM Breach Leaks 980 People's Data
980Impact: Personal data of 980 people
Personal data was leaked in a hack at Hanjin Information Systems & Telecommunication, an IT services company of the Hanjin Group. It was disclosed on October 24, 2026 that unauthorized access to its ITSM system leaked the personal data of 980 people.
Related reports: 3 · last report →
Supply-chain breaches
Frontline Education hack exposes data on more than 3.08 million people
3.1MImpact: Personal information of 3,085,266 students and staff members
Unauthorized access exploiting a vulnerability in third-party software occurred at Frontline Education on August 14–15, resulting in the theft of information on students and staff in U.S. school districts. Affected data from Frontline Central and school health management services included names, Social Security numbers, dates of birth, government-issued identification numbers, Medicaid and student identification numbers, and school health and billing records. Individual notifications have begun, and at least six class-action lawsuits are underway. A filing in Indiana confirmed that 3,085,266 people were affected.
Related reports: 14 · last report →
Also affected: 2- Klein Independent School DistrictFrontline Breach May Have Exposed Klein School District Employee DataPossible exposure of district employee information
- Greenville County SchoolsGreenville County Schools student data leaks from third-party softwareNames, student ID numbers, dates of birth, Medicaid billing numbers and other data of current students and graduates
Amadeus breach exposes 106,661 Korean Air customer booking records
↳ Knock-on damage from the Amadeus incident · View original incidentImpact: 106,661 customer booking records (PNRs)
Unauthorized access using account login credentials at Amadeus, Korean Air’s reservation and ticketing systems partner, exposed 106,661 customer booking records. Amadeus blocked further access by the account on September 23 but notified Korean Air 27 days later, on October 20. The customer data breach and an investigation into its scope became public on October 23, and follow-up reporting in November confirmed the precise number of exposed records and the notification delay.
Related reports: 21 · last report →
Amadeus reservation system breach exposes passenger data at multiple airlines
Impact: Passenger booking data exposed at multiple airlines
Unauthorized access to the reservation system of Spanish travel technology company Amadeus exposed passenger booking data at multiple airlines. In addition to names and itinerary details, some passport numbers and contact details were exposed, with Japan Airlines, ANA and Cathay Pacific among the affected airlines. Further reports followed from Korean Air, Asiana Airlines and others, while Thailand's aviation authorities confirmed that Thai Airways and Bangkok Airways were affected among seven major airlines.
Related reports: 9 · last report →
Also affected: 11- Korean AirAmadeus breach exposes 106,661 Korean Air customer booking records106,661 customer booking records (PNRs)
- Cathay PacificAmadeus breach exposes about 53,000 Cathay Pacific bookingsData on about 53,000 bookings
- Japan AirlinesJapan Airlines vendor hack leaks data on about 92,000 customersInformation on about 92,000 customers
- All Nippon AirwaysAmadeus Breach May Have Exposed ANA Customer Booking DataBooking data of about 37,800 customers affected
- Malaysia AirlinesAmadeus breach may have exposed Malaysia Airlines customer data
- QantasQantas investigates booking data impact from Amadeus breach
- Singapore AirlinesAbout 46,000 Singapore Airlines booking records accessed without authorizationApproximately 46,000 booking records
- NH NongHyup TravelSigns of customer flight booking number leak found at NH NongHyup Travel
- FinnairAmadeus breach exposes around 116,000 Finnair bookingsAround 116,000 bookings within the scope of exposure; around 750 actually viewed
- Thai AirwaysAmadeus breach exposes about 60,529 Thai Airways booking recordsAbout 60,529 passenger booking records affected, with approximately 376 potentially containing additional personal information
- NorwegianEarlier Amadeus breach exposed data of 144,249 Norwegian and Widerøe passengersInformation belonging to 144,249 passengers
Key incidents in other countries
GMO Internet cloud breach leaks customer data and causes trading losses
Impact: Up to 26,739 servers affected; loss compensation claims totaling 2.99 billion yen for 2,943 accounts
GMO Internet's Onamae.com Desktop Cloud suffered a malware attack that affected up to 26,739 servers, resulting in customer data leaks and asset losses from unauthorized trades. The company advised customers to shut down their PCs and offered a bounty to track down the attackers, while acknowledging that it had not adequately responded to earlier warnings about security vulnerabilities. By November 12, claims for loss compensation totaling 2.99 billion yen had been submitted for 2,943 accounts, while the final loss amount remained undetermined.
Related reports: 70 · last report →Hacked Ukrainian air raid alert app sends false threat notifications
Impact: False alerts about nuclear and chemical threats and other dangers displayed in the air raid alert app
Ukraine's air raid alert app was hacked and displayed false alerts about nuclear and chemical threats, urban combat and missile deployments. Authorities explained that there was no actual radiation threat and announced about an hour later that the false notifications had been removed and the system restored to normal. Air raid sirens and separate alert channels continued to operate normally.
Related reports: 38 · last report →Moderna-Merck Melanoma Vaccine Trial Data Leaked Ahead of Release
Impact: Some Phase 3 melanoma vaccine trial data leaked early, and share prices fell
Some Phase 3 clinical trial data on the Moderna and Merck melanoma vaccine leaked before the official announcement. The two companies released the clinical data early after the leak. Both companies' shares fell around the leak, and Moderna's share price appeared to stabilize on October 27.
Related reports: 29 · last report →Chainalysis breach exposes all users’ credentials
Impact: Exposure of all users’ credentials and active tokens
An external attacker accessed Chainalysis’s internal systems and tools, exposing customer names, email addresses, user IDs, and other information. The company disclosed the incident on October 30, notified customers, and launched an investigation with external experts, initially stating that it had found no evidence of unauthorized access to credentials or session tokens. It later confirmed that all users’ credentials and active tokens had been exposed, along with password hashes and some customers’ passwords. Major services were disrupted, and service restoration began on November 6.
Related reports: 28 · last report →State Bank of India customer data leaked on dark web
375KImpact: Indications that records relating to approximately 375,000 customers were stolen and circulated
State Bank of India launched an investigation after being notified that material on the dark web contained 3,897 customer records, and individually notified affected customers. The leaked material included names, contact details, addresses, dates of birth, customer identifiers and metadata from loan-related records. On November 14, further details of a police investigation emerged indicating that records relating to approximately 375,000 customers had been stolen and circulated following a breach of the bank’s global IT center in Navi Mumbai.
Related reports: 25 · last report →