Week 44, 2026 security incident report
Hacking and data breach incidents newly reported 2026.10.26 ~ 11.01
From October 26 to November 1, 60 new incidents were recorded in South Korea; among the major cases, the hack of a Daishin Securities server linked to account opening, which leaked eight categories of personal data on 38,490 customers, received the most coverage. Breaches in the financial sector followed in succession, including at Mirae Asset Life Insurance and Mirae Asset Global Investments, and personal data leaks also occurred at apartment community, aviation, travel and welfare services, highlighting damage to sensitive information such as resident registration numbers, account numbers and passport information. Across all types, personal data leaks were the most common at 172, and in South Korea, chain damage spreading from Douzone Bizon to hospitals, public institutions, publishers and others, as well as chain damage via Daehong Communications, Money Today and Hanwha Systems, stood out. Overseas, among 229 new incidents, about $6.4 billion in crypto asset losses from a Binance hot wallet hack drew major attention, and a leak of U.S. Department of Homeland Security employee information and disruptions to medical, teaching and research operations at the University of New Mexico were also reported.
By type
- Data breach166
- Hacking & intrusion53
- Ransomware31
- Malware9
- Phishing & smishing5
- DDoS1
Key incidents in South Korea
Financial Security Institute hack exposes data from 48 financial firms
350Impact: An estimated 130 or more files from 48 financial firms leaked, along with approximately 200 administrative forms, more than 300 personal information entries, and more than 350 system user information records
The Financial Security Institute detected a data leak from its continuous information security assessment system at around 3 p.m. on November 9, blocked access, and reported the incident to the Financial Services Commission (FSC) and the Korea Internet & Security Agency (KISA). An estimated 130 or more files from 48 financial firms were leaked, along with approximately 200 administrative forms, more than 300 personal information entries in those forms, and more than 350 system user information records. The attacker bypassed SMS verification to create an account impersonating the Financial Supervisory Service and exploited inadequate access authorization checks in an operational inspection feature. The institute blocked 246 attacking IP addresses, while the FSC launched an on-site inspection and announced a targeted audit.
Related reports: 169 · last report →Mirae Asset Securities breach affects about 3,800 customers and 35,255 personnel
35.3KImpact: Account numbers of about 3,800 customers and personal information of 35,255 employees, former employees, and outsourced staff
Mirae Asset Securities was attacked on November 4 and 5, resulting in the leak of account numbers belonging to about 3,800 customers and personal information belonging to 35,255 employees, former employees, and outsourced staff. The attacks targeted its mobile web login service using mobile phone authentication and its groupware, and the leaked personnel information included names, email addresses, mobile phone numbers, and encrypted passwords. The Financial Supervisory Service (FSS) launched an on-site inspection and confirmed links among multiple attacks.
Related reports: 119 · last report →Daishin Securities hack exposes information on over 38,000 customers
38KImpact: Personal information of over 38,000 customers
A hacking incident at Daishin Securities on October 27 exposed information on over 38,000 customers. The exposed information included addresses and encrypted account numbers, and Daishin Securities said there had been no resulting harm. On November 9, the company announced support measures for affected customers, including one year of insurance covering up to KRW 10 million in losses from voice phishing and smishing, a waiver of trading fees for Korean stocks in December, and a cash payment of KRW 10,000.
Related reports: 81 · last report →GS E&C apartment community system hacked, exposing residents’ data
Impact: Personal information of some apartment residents; affected complexes and number of people under investigation
GS Engineering & Construction’s apartment community facility reservation and management system was hacked, exposing some residents’ personal information. The affected complexes and number of people are under investigation, with addresses, encrypted passwords, administrator IDs and RF card numbers among the information potentially exposed. After GS E&C declined to consent to an investigation by the Korea Internet & Security Agency (KISA), citing its own investigation, the Ministry of Science and ICT decided on November 11 to launch an ex officio investigation into the cause and scale of the incident.
Related reports: 58 · last report →Hanyang Securities groupware hack exposes 31 personal information records
31Impact: 31 personal information records involving customers, employees, and others, including three records exposing resident registration numbers
An external groupware platform used by Hanyang Securities was hacked, exposing 31 records in total: 15 containing customer information, two containing employee-related information, and 14 containing general personal information. The exposed information included names, resident registration numbers, driver's license numbers, and bank account numbers, with resident registration numbers exposed in three records. Hanyang Securities said an insufficient access control vulnerability in Daou Office was the direct cause and that the breach occurred before a patch was released. It is now considering building its own business system.
Related reports: 43 · last report →Mirae Asset Life Insurance hack exposes customer, retirement pension, and employee data
Impact: Customers' personal information, retirement pension transaction data, and employee information
A leak of customers' personal information following a hack at Mirae Asset Life Insurance was confirmed on October 26. In addition to names, resident registration numbers, and bank account numbers, retirement pension transaction data and employee information were also confirmed to have been exposed. The company carried out emergency response and recovery work, while the shutdown of its website disrupted access to some online services. The Financial Supervisory Service extended its on-site inspection as the scope of the damage changed.
Related reports: 38 · last report →HYBE hack exposes employee and partner personal data
Impact: Personal information belonging to some current and former personnel and partner company representatives, as well as internal documents
Unauthorized access to HYBE’s internal systems occurred on two occasions, September 12–13 and October 3–5, exposing internal documents and personal information belonging to some current and former personnel and partner company representatives. Evidence of intrusion through an external document preview solution linked to the electronic approval system and through the expense processing system was confirmed, and the exposed information included resident registration numbers, passport numbers, bank account numbers, card numbers, and medical information. HYBE apologized, and police launched a preliminary inquiry on November 3.
Related reports: 36 · last report →Gmarket API flaw exploited to leak personal data and misuse e-coupons
900KImpact: 900,000 people reported as affected by the personal data leak
On October 28–29, unauthorized access exploiting a vulnerability in an external service API at Gmarket exposed customers' personal data and e-coupon PINs, and some e-coupons were used without authorization. The exposed data included names, user IDs, phone numbers, email addresses, and addresses. The company blocked the access route, reported the incident to the Korea Internet & Security Agency (KISA), and requested a police investigation; on November 1, it completed full compensation for losses from unauthorized use and payments of 10,000 won in Smile Cash to customers whose personal data was exposed, while replacement of gift certificate PINs was underway.
Related reports: 34 · last report →DOUZONE BIZON server breach raises wider concerns over client data exposure
Impact: As of November 5, 28 companies and institutions had issued notices of possible personal data leaks; the actual scale of any leak remains unconfirmed
Two security breaches were confirmed at DOUZONE BIZON, raising the possibility that personal data belonging to client companies and third parties whose data those clients held may have been leaked. Historical records of companies whose services had ended may also have been affected, and as of November 5, 28 companies and institutions had issued notices of possible data leaks. DOUZONE BIZON voluntarily reported the incidents to the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission (PIPC) and disclosed progress on security investments totaling 16 billion won. The government deemed the incidents serious and launched a joint public-private investigation, while whether data was actually leaked and the scope of any leak remain under investigation.
Related reports: 27 · last report →Jin Air hack exposes personal data of 1,454 members
1.5KImpact: Eight categories of personal data belonging to 1,454 members
An external attack targeting Jin Air’s member information lookup API exposed eight categories of personal data, including names and phone numbers, belonging to 1,454 members. Passwords and payment information were not compromised. Jin Air announced the breach on October 29, blocked the attacking IP addresses and access to the systems involved, and said it would notify affected customers individually. Questions subsequently arose about internal system problems and whether responsibility for the incident contributed to the CEO’s resignation, while further system reviews continued.
Related reports: 24 · last report →
Supply-chain breaches
Amplitude Internal System Breach Affects Customer Data
Impact: Event data of less than 0.3% of all customer accounts
Amplitude detected and blocked unauthorized access to some of its internal systems on September 28. Event data belonging to less than 0.3% of all customer accounts was affected, and the specific leaked items and number of people have not been disclosed. The company disclosed the incident in a customer security notice on October 28.
Read on Ally Security ↗
Also affected: 1- CoinbaseAmplitude Breach Exposes Coinbase Customer Contacts and Transaction DataContact details and limited transaction data of some customers exposed; number of victims not disclosed
Breach at Booking Supplier for Swedish Attractions Exposes Visitor Data
Impact: Visitors' names, addresses, phone numbers, email addresses and booking- and purchase-related information
Visit, the booking supplier for Swedish attractions Liseberg and Skansen, was breached, exposing visitors' personal data. The exposed data included names, addresses, phone numbers, email addresses and booking- and purchase-related information. Payment card information was not included.
Read on eBuilder Security ↗
Also affected: 1- LisebergData of About 15,000 Liseberg Users in Sweden ExposedNames, contact details and booking-related information of about 15,000 users
Amadeus reservation system breach exposes passenger data at multiple airlines
Impact: Passenger booking data exposed at multiple airlines
Unauthorized access to the reservation system of Spanish travel technology company Amadeus exposed passenger booking data at multiple airlines. In addition to names and itinerary details, some passport numbers and contact details were exposed, with Japan Airlines, ANA and Cathay Pacific among the affected airlines. Further reports followed from Korean Air, Asiana Airlines and others, while Thailand's aviation authorities confirmed that Thai Airways and Bangkok Airways were affected among seven major airlines.
Related reports: 9 · last report →
Also affected: 11- Korean AirAmadeus breach exposes 106,661 Korean Air customer booking records106,661 customer booking records (PNRs)
- Cathay PacificAmadeus breach exposes about 53,000 Cathay Pacific bookingsData on about 53,000 bookings
- Japan AirlinesJapan Airlines vendor hack leaks data on about 92,000 customersInformation on about 92,000 customers
- All Nippon AirwaysAmadeus Breach May Have Exposed ANA Customer Booking DataBooking data of about 37,800 customers affected
- Malaysia AirlinesAmadeus breach may have exposed Malaysia Airlines customer data
- QantasQantas investigates booking data impact from Amadeus breach
- Singapore AirlinesAbout 46,000 Singapore Airlines booking records accessed without authorizationApproximately 46,000 booking records
- NH NongHyup TravelSigns of customer flight booking number leak found at NH NongHyup Travel
- FinnairAmadeus breach exposes around 116,000 Finnair bookingsAround 116,000 bookings within the scope of exposure; around 750 actually viewed
- Thai AirwaysAmadeus breach exposes about 60,529 Thai Airways booking recordsAbout 60,529 passenger booking records affected, with approximately 376 potentially containing additional personal information
- NorwegianEarlier Amadeus breach exposed data of 144,249 Norwegian and Widerøe passengersInformation belonging to 144,249 passengers
Benefit One Discount Service Leaks Data of 29,465 Members
29.5KImpact: Personal data of 29,465 users
Unauthorized access to the systems of the contractor for Benefit One's Tokukai discount service from October 14 to 20 leaked the personal data of 29,465 users. The leaked information included, depending on the member, name, date of birth, email address and customer number. The service was temporarily suspended, and credentials used to link to the payment system were also changed after they were found to be possibly leaked.
Related reports: 2 · last report →
Also affected: 1- Credit Saison Co., Ltd.Personal Data of 29,465 Users of Saison Card Perks Service LeakedPersonal data of 29,465 Toku-Kai users
US education software breach exposes data on 1.3 million people
1.3MImpact: Personal information on more than 1.3 million students and staff
A vulnerability in third-party software was exploited at a US education administration software company, exposing personal information on more than 1.3 million students and staff. The attacker gained access on August 14, 2026, and the stolen information included Social Security numbers, dates of birth, identification document numbers and health insurance information.
Read on IANS ↗
JapanTicket external analytics tool breach leaks customer data
264KImpact: Up to about 264,000 customer records
Unauthorized access to an external analytics tool used by JapanTicket leaked up to about 264,000 customer records. The leaked data included names, email addresses, phone numbers, countries, and booking and order details, but not card numbers. The company is also investigating whether about 70,000 bookings for the 2024 Mt. Fuji Yoshida Trail passage are included.
Related reports: 3 · last report →
Also affected: 1- Yamanashi PrefectureData on About 70,000 Mount Fuji Trail Reservations in Yamanashi Possibly LeakedPossible leak of about 70,000 records of information on users who reserved on the Mount Fuji Yoshida Trail
Taiwan's 91APP order database breach may expose data of 4.8 million consumers
4.8MImpact: Potential exposure of information on 4,798,255 consumers across up to 1,329 brands
A breach of Taiwanese e-commerce platform 91APP's order database raised concerns that 4,798,255 consumers across up to 1,329 brands could be affected. Names, phone numbers, shipping addresses, email addresses, and order histories were potentially exposed, but the actual extent of unauthorized access or theft has not been confirmed. 91APP allowed consumers to apply for compensation even without financial losses and moved the application channel from Google Forms to its official website. Taiwan's Ministry of Digital Affairs suggested a link to the AI hacking tool ARTEX.
Related reports: 27 · last report →
Also affected: 2- MUJI Taiwan91APP breach may have leaked order data of about 180,000 MUJI Taiwan membersPossible leak of online order data of about 180,000 members
- COSMEDCOSMED affected by 91APP hack
Daehong Communications Leaks Data of 18,359 Customers, Coupon Service Suspended
18.4KImpact: Personal data of 18,359 customers leaked; use of mobile coupons for 24 brands restricted
The personal data of 18,359 customers was leaked from Daehong Communications, and no financial damage has been confirmed. The suspension of the Giftiel service restricted the lookup, use, approval and cancellation functions of mobile coupons for 24 brands. The operator extended coupon validity by 30 days and worked on recovery, aiming to normalize the service on November 4.
Related reports: 3 · last report →
Also affected: 1- Lotte GRSGiftiL hack disrupts Lotte Eatz membership couponsDisruption to Lotte Eatz membership coupon use
Unauthorized access to MoneyToday exposes 1,367 personal data records
1.4KImpact: 1,367 personal data records
MoneyToday suffered a leak of 1,367 personal data records following unauthorized external access. The leaked information included the English names and work phone numbers of applicants to the the300 Policy Academy, as well as the company names and job titles of newsletter subscribers. The access route was blocked on September 25, and a follow-up review on October 27 established the scale of the leak; the Personal Information Protection Commission (PIPC) is investigating.
Related reports: 9 · last report →
Also affected: 1- Donghaeng Media SidaeMoney Today Hack Leaks 526 Donghaeng Media Sidae Subscriber Records526 subscriber personal data records
KDDI customer data may have leaked through Lifenet Insurance system
22.5KImpact: Possible leak of 22,541 KDDI customer records
Exploitation of a vulnerability in Lifenet Insurance’s KDDI-linked system was found to have potentially exposed 22,541 KDDI customer records. The information concerned includes names, postal codes, phone numbers, email addresses and member identifiers. Some insurance application functions were also suspended.
Related reports: 2 · last report →
Also affected: 1- KDDIUp to 22,541 KDDI customer records may have leakedPossible leak of up to 22,541 customer records
DOUZONE BIZON server breach raises wider concerns over client data exposure
Impact: As of November 5, 28 companies and institutions had issued notices of possible personal data leaks; the actual scale of any leak remains unconfirmed
Two security breaches were confirmed at DOUZONE BIZON, raising the possibility that personal data belonging to client companies and third parties whose data those clients held may have been leaked. Historical records of companies whose services had ended may also have been affected, and as of November 5, 28 companies and institutions had issued notices of possible data leaks. DOUZONE BIZON voluntarily reported the incidents to the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission (PIPC) and disclosed progress on security investments totaling 16 billion won. The government deemed the incidents serious and launched a joint public-private investigation, while whether data was actually leaked and the scope of any leak remain under investigation.
Related reports: 27 · last report →
Also affected: 24- Asan Chungmu HospitalAsan Chungmu Hospital warns business partner data may have leaked in external backup server breachPossible leak of business partners' account details and other data
- National Museum ComplexDOUZONE BIZON hack raises data leak concerns at National Museum ComplexPotential leak of personal information, including resident registration numbers and bank account numbers; scale unconfirmed
- ChangbiChangbi warns of possible author and business partner data leak after Douzone Bizon hack
- Changbi EducationChangbi Education authors' and business partners' personal data possibly leaked
- Charmzone AutomotiveCharmzone Automotive customers' personal data possibly leaked
- PetdocPetdoc's former Hairu employees' and business partners' data possibly leaked
- WithYouWithYou notifies of possible leak of employees' personal data
- Jaewon FoodJaewon Food employees' and franchise owners' personal data possibly leaked
- Korea Ladies Professional Golf AssociationKorea Ladies Professional Golf Association members' personal data possibly leaked
- Chuncheon Cultural FoundationChuncheon Cultural Foundation personal data possibly leaked via external backup server breach
- K AuctionK Auction personal data left in backups after service termination possibly leaked
- Korea Airport SecurityKorea Airport Security faces possible data leak linked to Douzone Bizon hack
- Sunghyun Accounting CorporationDouzone Bizon server breach raises concerns over Sunghyun data leak
- KukkiwonDOUZONE BIZON backup server breach raises concerns over Kukkiwon data leak
- Theborn KoreaTheborn Korea warns of possible personal data leak after vendor server breach
- Jeonbuk Culture & Tourism FoundationJeonbuk Culture & Tourism Foundation warns of possible leak of staff personal dataPossible leak of resident registration numbers, account numbers, payroll and HR information of employees, business partner staff and others
- KEPCO ESKEPCO ES warns of possible personal data leak after DOUZONE BIZON hackPossible leak of personal information, including resident registration numbers and contact details
- Seoul Support Center for ChildcareSeoul childcare support center warns of possible staff and instructor data leakPossible leak of personal information, including resident registration numbers and bank account numbers, belonging to current and former employees, instructors, and others
- Gwangju Foundation for Women & FamilyGwangju Foundation for Women & Family warns of possible data leak from external backup server
- KAC Airport ServiceKAC Airport Service warns of possible data leak linked to Douzone Bizon breach
- T1Douzone Bizon backup service breach may expose T1 players' personal dataPotential leak of resident registration numbers, passport numbers, and salary records belonging to players and others
- Jeonnam Information & Culture Industry Promotion AgencyDouzone Bizon backup service breach raises data leak concerns at Jeonnam agency
- AgileSoDAAgileSoDA staff data potentially exposed in external backup server breachPossible exposure of employees' and executives' unique identification data, financial information, and personnel, payroll, and tax records
- Gwangju Tourism OrganizationGwangju Tourism Organization warns of possible data leak after DOUZONE BIZON breachPossible leak of personal information stored with an outsourced service
Hanwha Systems ICT Unit Breach Leaks Employee Personal Data
1.7KImpact: Leak of employee personal data; actual damage under investigation on a server holding information on about 1,700 people
Unauthorized access to servers of Hanwha Systems' ICT division, using external access accounts of some affiliates, led to the leak of employees' names, contact details and company email addresses. The servers held information on about 1,700 people, and the actual scale of the damage is under investigation. Hanwha Systems reported the incident to the Korea Internet & Security Agency and said its defense and financial affiliates were not affected.
Related reports: 7 · last report →
Also affected: 1- Hanwha EnginePossible leak of 1,903 personal data records concerning Hanwha Engine employees and othersPossible leak of 1,903 personal data records concerning employees and partner company staff
PowerSchool hack leaks student and staff personal data
62MImpact: Leak of student and staff personal data; the attacker claimed to have stolen data on 62 million students
Education technology company PowerSchool was hacked, leaking personal data of students and staff at North American schools. The attacker claimed to have stolen data on 62 million students, and PowerSchool paid the hacker, but school districts were later hit with further extortion demands. A US college student involved in the case pleaded guilty and was later sentenced to federal prison.
Related reports: 105 · last report →
Also affected: 9- Walker County SchoolsWalker County Schools student information system data leaked
- Bozeman School DistrictBozeman School District students and teachers hit by PowerSchool data breachStudent and teacher data affected; scale unknown
- Union County Public SchoolsUnion County Public Schools hit by student information system breach
- Frederick County Public SchoolsFrederick County Public Schools affected by PowerSchool data breach
- Toronto District School BoardPowerSchool breach: 40 years of Toronto school board student data stolen40 years' worth of student data
- Centers for Medicare & Medicaid Services (CMS)CMS confirms impact from PowerSchool data breach
- Mercyhurst Preparatory SchoolPowerSchool cyberattack may have exposed Mercyhurst school data
- Buford City SchoolsPowerSchool hack exposes Buford City Schools student and teacher dataStudent and teacher data
- Three international schools in SeoulPowerSchool hack exposes 15,666 personal data records at three Seoul international schools15,666 personal data records
Key incidents in other countries
Binance hack steals $6.3 billion in crypto assets
Impact: $6.3 billion in crypto assets stolen
Around October 29, 2026, $6.3 billion in crypto assets was stolen from Binance. A subsequent investigation revealed how North Korean attackers tricked an employee through a fake job interview into installing malware and compromised wallet infrastructure. Binance resumed withdrawals and completed full reimbursement of affected customer assets, while the US government pursued freezing and seizure proceedings for some of the stolen assets.
Related reports: 303 · last report →Data on over 41,000 Homeland Security employees leaked
41KImpact: Information on more than 41,000 employees
Information on more than 41,000 U.S. Department of Homeland Security employees was stolen and published online. The leaked material included information on Immigration and Customs Enforcement and Customs and Border Protection employees, as well as the identities of undercover agents. The Department of Homeland Security launched an investigation into the leak.
Related reports: 77 · last report →GMO forex service hack leads to unauthorized trades and customer losses
Impact: Reported losses across 2,943 accounts totaling ¥2.99 billion; related costs, including compensation, of ¥3.05 billion
Unauthorized access to GMO's foreign exchange trading service resulted in a data leak and unauthorized trades. As of November 13, users had reported losses totaling ¥2.99 billion across 2,943 accounts, while costs including compensation for customer losses and goodwill payments totaled ¥3.05 billion. GMO conducted a group-wide review. It also emerged that vulnerabilities had been flagged and a system redesign proposed two years earlier, but no action had been taken.
Related reports: 36 · last report →Taiwan's 91APP order database breach may expose data of 4.8 million consumers
4.8MImpact: Potential exposure of information on 4,798,255 consumers across up to 1,329 brands
A breach of Taiwanese e-commerce platform 91APP's order database raised concerns that 4,798,255 consumers across up to 1,329 brands could be affected. Names, phone numbers, shipping addresses, email addresses, and order histories were potentially exposed, but the actual extent of unauthorized access or theft has not been confirmed. 91APP allowed consumers to apply for compensation even without financial losses and moved the application channel from Google Forms to its official website. Taiwan's Ministry of Digital Affairs suggested a link to the AI hacking tool ARTEX.
Related reports: 27 · last report →Arara email service hack exposes 81.33 million email addresses
81.3MImpact: 81,329,467 email addresses and some customers' member information
Japan's Arara Message email delivery service was breached through a web server vulnerability, exposing email addresses and some customers' member information. Further investigation put the number of unique email addresses exposed at 81,329,467. The attacker also abused the service to send up to approximately 7.13 million emails impersonating credit card companies, and the company isolated the servers and completely suspended its email delivery service.
Related reports: 20 · last report →