South Korea

Attackers used a fake regulator account to breach Korea's Financial Security Institute assessment system, taking files from 48 financial firms

KBS and Yonhap report that the information protection assessment support system of Korea's Financial Security Institute was hacked on November 9, 2026; the institute confirmed some data leaked, blocked the system and reported to the Financial Services Commission, and files from about 48 financial firms, some 130 in total, are estimated to have leaked .

Mirae Asset Securities announced that its internal groupware system, mi-global, suffered an external attack on November 5, leaking personal data of approximately 35,255 employees, including former and outsourced personnel .

According to BleepingComputer, Japan Airlines said Amadeus notified it on October 23 of unauthorized access to its Passenger Service System between August 10, 2023 and September 23, 2026, exposing booking codes, names and flight details of about 92,000 JAL customers, plus emails, phones and passport numbers for about 2,000; ANA, Asiana and Korean Air also confirmed impact .

Korean enterprise software vendor Douzone Bizon said on October 23, 2026 that attackers used a flaw in the backup solution behind its APO backup service to exfiltrate some encrypted data from backup servers, adding that it has found no sign the encryption keys leaked and has not yet identified affected customers or individuals .

According to Yonhap, security firm Oasis Security found data from two large Korean churches on an overseas attacker server; one was breached via a web shell on its ERP server with database admin rights obtained, while the other's groupware was accessed with previously obtained accounts and then its ERP via single sign-on .

Weverse, the fan platform of South Korea's HYBE, said that on September 3 the Korea Internet & Security Agency told it an outside party had reported a vulnerability, and an inspection confirmed data of 422,584 accounts leaked .

A joint government-civilian team under Korea's science ministry confirmed data from 39.

According to The Korea Times, Seoul Facilities Corporation, which runs the Ttareungyi bike service, said on January 30 it was told by police that data of about 4.

According to BleepingComputer, South Korean education group Kyowon confirmed a ransomware attack in which data was exfiltrated and is investigating with authorities whether customer information was included .

South Korea's Personal Information Protection Commission found that failures in managing authentication signing keys and access controls at Coupang led to the leak of about 37.

According to The Korea Herald, an investigation revealed that KT servers had been infected with malware and that the company failed to promptly notify regulatory authorities .

According to Yonhap News Agency, Lotte Card confirmed that a hacking incident resulted in the exposure of personal data belonging to approximately 2.

According to Korea JoongAng Daily, South Korean media reported that online bookstore Yes24 suffered a ransomware attack .

South Korea's Ministry of Science and ICT (MSIT) issued a statement regarding the cybersecurity incident at SK Telecom .