Advisories

South Korea's Yoido Full Gospel and SaRang megachurches breached; data of about 850,000 and 89,000 members suspected leaked

According to Yonhap, security firm Oasis Security found data from two large Korean churches on an overseas attacker server; one was breached via a web shell on its ERP server with database admin rights obtained, while the other's groupware was accessed with previously obtained accounts and then its ERP via single sign-on .

ASOS employee tricked into handing over login credentials; customer data and search history stolen and app push abused

The UK NCSC said some ASOS customers received an unauthorized push notification from the ASOS app on October 6, and the company confirmed customer names and contact details were accessed .

On October 6, 104 Corporation issued a material information filing on MOPS stating that it had detected abnormal read activity on its App system, and an investigation confirmed that approximately 120,000 resume records were read without authorization .

Japanese restaurant group Monogatari Corporation said on October 5 that the member management system of its Yakiniku King official app was accessed by a third party on October 2, and that it confirmed a leak of member data on October 3 .

According to The Record, the Danish government said on October 5 that someone exploited an unnamed Danish company's legitimate access to the Central Person Register (CPR) to obtain the names, addresses and CPR numbers of about 8.

According to iThome, on October 1, restaurant chain operator An-Shin Food Services (1259), which operates MOS Burger in Taiwan, issued a material announcement on the Market Observation Post System (MOPS), stating that a small number of consumers reported suspected unauthorized acquisition of personal data from a platform managed by an outsourced vendor, followed by email contact from third parties .

Hana Bank said an illegal intrusion into its sales support system on September 30, 2026 led to the leak of information on 89 customers, confirmed on October 2 .

K-12 administration software provider Frontline Education said it identified unauthorized activity tied to a vulnerability in a third-party software product on Aug 14, 2026, which allowed access to part of its environment, with the last unauthorized activity on Aug 15 .

E-commerce technology provider 91APP confirmed that one of its Commerce Cloud order databases was illegally accessed on October 3 via an unpatched third-party tool, Appsmith, after which the attacker retrieved database credentials from an internal GitLab instance .

InvoiceOcean said that on September 28, 2026 it established a personal data breach in which an unauthorized person accessed its systems from September 27 and copied a large part of the database, affecting every account in the service .

According to Media Innovation, The Japan Times and group company News2u Holdings disclosed unauthorized access to a group server on October 2 and said in a second report on the 16th that a ransomware attack was confirmed on September 18, hitting a file server used by administrative departments until August 2022 .

According to fuitededonnées.

According to fuitededonnées.

Japanese convenience store chain Seicomart said in its fourth report on October 5 that unauthorized access via the Seicomart app server affected 574,647 Seicomart Club members who had registered with the app .

According to iThome, International Games System (IGS) announced on September 29 that it detected anomalous intrusion into operational IT equipment from unknown IP addresses .

According to iThome, Senao International announced on September 29 that an external server suffered an automated attack in which partial order information was extracted .

On October 7, International Games System Co.

Park24 said a third-party intrusion into the Times Car web system leaked customer information, first announcing it on 25 September and updating the findings in a fifth report on 23 October .

According to Military Times, a September 18 notification letter from the Defense Manpower Data Center (DMDC) says it found a vulnerability in a file-sharing system on July 16 and that unauthorized users accessed files with unencrypted personal data on a server between October 2025 and July 16, 2026 .

Abnormal access to the web system of Times Car, the car-sharing service of Japan's Park24, was detected on September 25, and the company announced a possible personal data leak that day and began a forensic investigation .