Hacking Incidents at 21 Sites Including Universities and Hospitals: Dormitory and Plastic Surgery Data Also Compromised

Selling Stolen Data from Small-Scale Websites

The government has confirmed recent trends in which an unidentified hacking group stole and sold internal data from 21 domestic hospitals, universities, and online shopping malls, and has urged heightened vigilance.

The Ministry of Science and ICT and the Korea Internet & Security Agency (KISA) shared findings on January 7 regarding incidents identified on hacking forums over the past month, stating, "A series of hacks are occurring targeting small-scale websites, so security inspections are required to prevent additional cyberattacks and the spread of further damage."

A hacking forum refers to an online community where illegal cyber activities such as sharing hacking information, selling stolen data, and distributing malware take place.

On one such forum, a hacker using the nickname 'AshleyWood2022' posted an advertisement selling databases related to Korean websites.

Initially, it was reported that 17 organizations, including Chungbuk National University, Geumgang University, Samsung Neo Information, and the Seogwipo City Childcare Support Center in Jeju, had been hacked. However, according to an investigation by the Ministry of Science and ICT, it is now estimated that a total of 21 organizations have fallen victim to hacking.

The Ministry of Science and ICT has reportedly identified additional cases among the databases posted by the hacker that appear to involve internal data leaks from domestic organizations and companies. Coupang, which recently suffered a large-scale data breach, was not included among the affected entities.

The leaked information is presumed to include website IDs, user names, email addresses, passwords, and other homepage subscriber information. It is also reported to include three years' worth of outing information from a university dormitory and information related to plastic surgery and liposuction clinics.

The Ministry of Science and ICT immediately shared details of the breach with the affected domestic organizations and companies. It also requested that these entities strengthen their security through a KISA security notice.

The Ministry of Science and ICT and KISA stated that they will continue to monitor the dark web and hacking forums for illegal distribution of domestic information and provide technical support to companies that have experienced breaches.