A hacker described by Korean media as likely Chinese claims to have breached 88 South Korean government agencies and roughly 20 private companies over a six-day campaign, and says financial, personal and military data was extracted. The claim was reported by IT Chosun on September 11, 2026, citing industry sources, and comes with an important caveat that the outlet states directly: the authenticity of the material the hacker presented, and whether any intrusion actually occurred, have not been verified. No victim organisation, regulator or national CERT has publicly confirmed the 88-agency figure. What is confirmed is the surrounding context, and it is ugly: a cluster of separate Korean breaches disclosed in the same fortnight, including 39.54 million compromised Tving accounts, 422,584 Weverse accounts, 219,665 Gangnam Unni users, and an active Financial Supervisory Service inspection of two payment gateway firms over card data attributed to a Chinese hacker.
What Happened
Per IT Chosun, the actor ran a six-day campaign against Korean government agencies and companies, then in early September notified major institutions including the Ministry of Science and ICT (MSIT) and the Korea Internet & Security Agency (KISA) directly. That notification pattern matters: the attacker chose disclosure to the regulator rather than an extortion note or a leak-site post.
The specific claims, all attributed to the hacker and none independently confirmed:
- Access to Incheon City's RFID-based government asset management system.
- Access to closed-circuit television location data in Cheongju.
- Database access credentials for 88 government agencies, including Incheon City Hall, Gwangju City Hall and the Gyeonggi Provincial Office, allegedly stored unencrypted in plain text.
- Extraction via an application programming interface that required no authentication.
- B2B data from approximately 20 companies.
IT Chosun reports the government and related agencies are investigating based on the materials the hacker supplied. Its framing that ministries are "being attacked" reflects the outlet's reporting of an ongoing situation, not a government statement, and should be read as such.
The Asia Business Daily reported separately on September 9 that the FSS launched on-site inspections at two payment gateway companies, Toss Payments and CoemPayments, after confirming that a Chinese hacker had caused the leakage of tens of thousands of credit card records. Its reporting says the volume runs to several thousand records per card issuer, with some customer data from nearly every Korean card company believed affected, and that authorities and the victim companies were unaware until the hacker disclosed the breach first. That outlet also raises, as a concern within the financial sector rather than a confirmed finding, that the actor may be using generative AI to target multiple companies simultaneously. Whether this PG activity is the same actor as the 88-agency claim is not established by any source; both are described as a Chinese hacker operating in the same window, which is suggestive, not conclusive.
What Was Taken
Accounts differ sharply on volume, and the honest answer is that the government-sector numbers are claims while the private-sector numbers are confirmed findings.
Claimed, unverified (IT Chosun): financial, personal and military information from 88 agencies and around 20 companies, plus plaintext database credentials and municipal CCTV location data. The actual scale of damage has not been confirmed.
Confirmed by investigation or company disclosure in the same period:
- Tving: 39.54 million user accounts and 361 technical assets including source code, per a three-month joint government-civilian investigation announced by MSIT on September 3 and reported by both the Korea Herald and UPI/Yonhap. The account total includes duplicate accounts held by the same users. Breakdown: 7.26 million direct registrations, 8.63 million CJ ONE integrated memberships, 22.47 million social logins via Naver, Kakao, Facebook, Apple and X. Of the total, 22.06 million were active and 17.37 million dormant or closed. Leaked data spanned 20 categories and 70 data types.
- Weverse (HYBE): 422,584 accounts, per the company's own September 6 notice signed by President Zooil Yang, calculated in account ID units. Weverse classifies only the internal identification value as personal information; the rest is payment metadata such as payment method, PG name, currency, purchase and cancellation amounts, timestamps and refund dates. Names, contact details and card numbers are not on its list.
- Gangnam Unni (Healing Paper): 219,665 users, including roughly 160,000 in South Korea and 48,000 in Japan plus users in Taiwan, Thailand and China. Beyond identity fields, the exposure covers cosmetic procedure names, hospital and doctor names, preferred appointment times, stated reasons for consultation, consultation status and user-submitted photos. That is medical-adjacent data with real coercion and stigma potential.
- Payment gateways: tens of thousands of card records including card numbers, expiration dates and partial PINs, per the Asia Business Daily.
Why It Matters
The pattern across these incidents is more important than the 88-agency headline. In at least three of the confirmed cases, the intrusion path was an API, not a phished credential or a ransomware loader. Healing Paper says an unauthorised party reached consultation records through an API, was blocked, then returned through a different channel the next day. Weverse says it tightened access controls on the API that processes payment information and removed internal identifiers after KISA relayed an external vulnerability report on September 3. The IT Chosun claim describes extraction through an API with no authentication at all. Korean organisations are being taken apart at the interface layer.
The second pattern is detection failure. The FSS inspection began because the hacker disclosed the breach, not because monitoring caught it. KT's PIPC-confirmed compromise ran for nearly 11 months, from October 8, 2024 to September 5, 2025, and surfaced only when users reported fraudulent micropayments; KT's initial notification put exposure at roughly 5,500 customers, while the regulator's investigation found 16,647 subscribers affected and KRW 240 million (about $167,400) in fraudulent payments against at least 368 of them. That gap between first self-report and final regulatory finding is the norm here, and it argues for treating every early breach number in this cluster as a floor.
Third, regulators are now pricing this. PIPC fined KT KRW 53.979 billion (about $39 million), per BleepingComputer. On August 26, 2026, PIPC resolved fines against GS Retail and three other operators totalling KRW 12.95444 billion, with KRW 12.836 billion of that against GS Retail alone for credential stuffing that exposed 1,581,025 GS SHOP members and 79,128 GS25 members. PIPC's cited failings are instructive: no detection or blocking for mass login attempts from a single IP, no recognition of anomalous login-failure spikes, no dedicated privacy organisation, and notification of 1,599 additional affected individuals more than 72 hours late without justification.
The Attack Technique
Across the confirmed incidents, three distinct techniques appear, and defenders should not collapse them into one story.
Unauthenticated and over-permissive APIs. The claimed government intrusion, the Gangnam Unni breach and the Weverse exposure all centre on API endpoints returning data without adequate authentication or authorisation. Healing Paper's experience, where the attacker pivoted to a second channel after the first was blocked, is the classic signature of an endpoint inventory problem rather than a single bug.
Plaintext credential storage. The hacker's specific claim that database access information for 88 agencies sat unencrypted is unverified, but it is consistent with the failure class PIPC keeps citing in its enforcement actions.
Credential stuffing. PIPC's GS Retail finding documents attackers reusing harvested credentials against consumer logins from June 21, 2024 to February 13, 2025 on GS SHOP and December 26, 2024 to January 4, 2025 on GS25, with 327 attacker IPs shared between the two campaigns.
Hardware trust abuse. The KT case is a different animal entirely: attackers recovered a valid authentication certificate from a lost femtocell, installed it on a self-built device that then presented as a legitimate node in KT's network, and intercepted mobile numbers, IMSI and IMEI plus SMS and ARS authentication codes used for micropayments. PIPC held KT responsible on the grounds that KT installed, owned and controlled authentication for those devices.
What Organizations Should Do
- Inventory every API endpoint and test each one unauthenticated. Enumerate shadow and legacy endpoints, not just the documented ones. Assume an attacker blocked on one route will try a second, as happened at Healing Paper within 24 hours.
- Enforce object-level authorisation, not just authentication. Confirm that an authenticated session cannot iterate identifiers to pull other users' records. Weverse's remediation, removing internal identifiers from payment API responses, points at exactly this failure mode.
- Audit credential storage across all systems, including municipal and legacy asset-management platforms. Grep configuration stores, backups and asset databases for plaintext connection strings. The claimed 88-agency compromise hinges entirely on this.
- Deploy rate-based and pattern-based login anomaly detection. PIPC fined GS Retail specifically for failing to detect mass login attempts from a single IP and failing to act on login-failure spikes. Reused attacker IPs across properties are a detectable, cheap signal.
- Treat authentication hardware as a controlled asset. Track femtocells, IoT gateways and any device holding a network certificate; revoke certificates on loss and monitor for duplicate certificate use from unexpected locations.
- Rehearse the 72-hour notification clock. PIPC penalised late notification of additional affected individuals discovered mid-investigation. Build a process that handles rolling scope expansion, because early figures in this cluster have consistently been revised upward.
- Do not wait for verification to act on hostile disclosure. Several of these victims learned of their breach from the attacker. If an actor claims your systems and supplies artefacts, treat it as an incident until the artefacts are disproven.
Sources: “Snarched 88 government agencies and 20 companies in South Korea” <... | South Korea fines telco giant KT $39 million for customer data breach | Data breach exposes sensitive data of 220,000 users on cosmetic pro... | Nearly 40 mln Tving accounts compromised in massive data breach | Nearly 40 mln Tving accounts compromised in massive S. Korea data b... | Exclusive Even Passwords Compromised by Chinese Hacker... Tens of T... | HYBE’s Weverse confirms data leak affecting 422,584 accounts, inclu... | 개인정보보호위원회