Coupang recovers laptop in river, Trust Wallet reports 2k+ wallets drained, Sax discloses 2024 data breach

Summary

Cyber Security Headlines – December 30, 2025

Host: Sarah Lane | Podcast: CISO Series
Main Theme:
A roundup of significant cybersecurity incidents affecting major organizations worldwide, including notable data breaches, ransomware attacks, and regulatory actions. The episode zeroes in on the human factor in breaches, delays in disclosure, technical mishaps, and highlights the ongoing threats to both consumer and employee data security.

---

Key Discussion Points & Insights

1. Coupang Recovers Laptop Dumped in a River (00:13)

• Incident: South Korean e-commerce giant Coupang recovered a MacBook Air that had been weighted down and dumped in a river, allegedly by a former employee attempting to destroy evidence related to a data leak.
• Scope: The device's forensic analysis revealed the employee accessed data from about 33.7 million accounts, retaining information from approximately 3,000 users.
• Breach Impact:
  • No signs of data being sold were uncovered.
  • Coupang is rolling out a 1.685 trillion won voucher compensation plan as part of the investigation.
• Notable Quote:
  • (Sarah Lane, 00:31) “Coupang says forensic analysis shows the employee accessed Data from about 33.7 million accounts and retained information from roughly 3,000 users— with no evidence of data being sold.”

---

2. Trust Wallet Chrome Extension Breach (01:03)

• Attack Details:
  • Attacker compromised Trust Wallet's Chrome browser extension on December 24.
  • Over 2,596 cryptocurrency wallets were drained, losing approximately $7 million total.
  • A malicious update, potentially enabled by a leaked Chrome Web Store API key, exfiltrated wallet data.
• Response:
  • Trust Wallet is reimbursing all affected users and investigating the cause.
• Notable Quote:
  • (Sarah Lane, 01:13) “Trust Wallet says it's reimbursing affected users and investigating how a leaked Chrome Web Store API key may have allowed the rogue release.”

---

3. Sachs 2024 Data Breach Disclosure (01:35)

• Details:
  • U.S. accounting firm Sachs experienced a cyberattack in August 2024 but only disclosed the breach and began notifying affected parties more than a year later.
  • Exposed data includes names, birth dates, Social Security numbers, and government IDs.
  • No ransomware group has claimed responsibility.
  • Sachs offers a year of credit monitoring for those affected.
• Notable Quote:
  • (Sarah Lane, 01:43) “The company apparently didn't complete its investigation or begin notifications until more than a year later.”

---

4. Korean Air Supplier Attack (02:08)

• Incident:
  • Korean Air's catering and duty-free subsidiary (KCND) was hacked, leaking personal data of about 30,000 employees (names, account numbers from the ERP system).
  • No customer data was affected.
  • CLOP ransomware group claimed responsibility and has already leaked the stolen data.
• Notable Quote:
  • (Sarah Lane, 02:22) “The CLOP Ransomware Group has claimed responsibility for the KCND attack and says it has already leaked the stolen data.”

---

5. Next Publica Fined for Data Breach in France (03:00)

• Regulatory Action:
  • CNIL, France’s data protection authority, fined Next Publica €1.7 million for failing to act on known vulnerabilities that led to a November 2022 data breach.
  • Users could access third-party documents; vulnerabilities were only patched after the breach.
  • Fine reflects sensitivity of compromised data, number of people affected, and lack of security safeguards—constituting a GDPR violation.
• Notable Quote:
  • (Sarah Lane, 03:19) “The fine reflects the sensitivity of the data, the number of people affected and Next Publica's lack of basic security safeguards.”

---

6. ‘Lovely’ Extortion Group Attacks Conde Nast (03:37)

• Attack Overview:
  • The group leaked data on 2.3 million Wired subscribers (email addresses, names, home addresses, phone numbers, and account metadata) after Conde Nast allegedly ignored security warnings.
  • Group claims to hold 40 million more records across other Conde Nast titles.
  • Data likely originated from infostealer malware; no payment card data leaked yet.
• Notable Quote:
  • (Sarah Lane, 03:54) “Researchers from Hudson Rock say the data appears authentic and likely stems from infostealer malware, though no payment card data has surfaced.”

---

7. Aflac Breach Affects 22 Million+ Customers (04:13)

• Details:
  • June cyber attack stole data on ~22.65 million individuals (names, addresses, Social Security numbers, gov’t IDs, medical/insurance information).
  • No ransomware was involved, and no known fraud reported yet.
  • Affected individuals are offered two years of credit and identity protection.
• Notable Quote:
  • (Sarah Lane, 04:23) “The intrusion was part of a broader campaign targeting the insurance industry, did not involve ransomware and has not yet led to known fraud.”

---

8. Romania’s Oltenia Energy Complex Hit by Ransomware (05:01)

• Attack Summary:
  • The country’s largest coal-based energy producer was attacked over Christmas: files were encrypted and ERP, email, and document management were knocked offline.
  • Power generation was not impacted; the company is restoring systems and investigating data theft.
  • “Gentleman Ransomware Group” claimed responsibility.
• Notable Quote:
  • (Sarah Lane, 05:17) “The company is rebuilding systems from backups, assessing whether data was stolen and has reported the incident to national cyber and law enforcement authorities.”

---

Memorable Quotes & Moments

• On Delayed Reporting:
  • (Sarah Lane, 01:43) “The company apparently didn't complete its investigation or begin notifications until more than a year later.”
• On Extortion and Data Authenticity:
  • (Sarah Lane, 03:54) “Researchers from Hudson Rock say the data appears authentic and likely stems from infostealer malware, though no payment card data has surfaced.”

---

Important Segment Timestamps

• 00:13 – Coupang recovers laptop
• 01:03 – Trust Wallet wallet drains
• 01:35 – Sachs data breach
• 02:08 – Korean Air supplier hack
• 03:00 – Next Publica CNIL fine
• 03:37 – Lovely leaks Conde Nast data
• 04:13 – Aflac breach
• 05:01 – Oltenia Energy ransomware attack

---

Takeaways

• Physical security lapses (Coupang) can have digital consequences; even extreme actions like destroying devices may not erase digital footprints.
• Browser extension risks are prominent, as shown by the Trust Wallet incident: software supply chains and API key security remain persistent weaknesses.
• Delayed breach notifications (ex: Sachs) risk regulatory action and erode consumer trust.
• Ransomware and data extortion continue to plague both critical infrastructure (Oltenia Energy, Korean Air) and publishers (Conde Nast), with attackers leveraging both data theft and operational disruption.
• Regulatory enforcement (Next Publica) is ramping up amidst rising privacy concerns and ongoing GDPR violations.

---

For daily, concise updates on major information security stories, see CISOseries.com.

Transcript

[A]

From the CISO series it's Cybersecurity Headlines.

[B]

These are the cybersecurity headlines for Tuesday, December 30, 2025. I'm Sarah Lane. Coupang Recovers laptop allegedly Thrown into River South Korean e commerce giant Coupang says it recovered a MacBook Air allegedly used by a former employee who leaked customer data after the device was weighted with bricks and thrown into a river in an apparent attempt to destroy evidence. Coupang says forensic analysis shows the employee accessed Data from about 33.7 million accounts and retained information from roughly 3,000 users with no evidence of data being sold. Coupang announced a 1.685 trillion won voucher compensation plan to during its investigation. Trust Wallet reports more than 2,000 wallets drained Trust Wallet says attackers drained about $7 million from 2,596 cryptocurrency wallets after compromising its Chrome browser extension on December 24. The malicious update exfiltrated wallet data and while the attacker accessed that many wallets, Trust Wallet says it's reimbursing affected users and investigating how a leaked Chrome Web Store API key may have allowed the rogue Release. Sachs discloses 2024 data breach US accounting firm Sachs says a cyber attack detected back In August of 2024 exposed personal data tied to around 228,876 people, but the company apparently didn't complete its investigation or begin notifications and until more than a year later. Stolen data may include names, dates of birth, Social Security numbers and government ID details. No ransomware group has claimed responsibility, but Saks is offering a year of credit monitoring Korean Air Shares Supplier Attack Korean Air disclosed a data breach after its in flight catering and Duty Free subsidiary Korean Air Catering and Duty Free or kcnd, which is was hacked, exposing personal data tied to around 30,000 airline employees. The airline says customer data was not affected and that the leaked information appears limited to employee names and account numbers stored on KCND's ERP system. The CLOP Ransomware Group has claimed responsibility for the KCND attack and says it has already leaked the stolen data. Huge thanks to our sponsor Threadlocker. Want real zero trust training? Zero Trust World 2026 delivers hand on labs and workshops that show CISOs exactly how to implement and maintain zero trust in real environments. Join us March 4th through the 6th in Orlando, plus a live CP CISO series episode on March 6th. Get 200 off with ZTW CISO [e-mail] Next Publica France find by CNIL France's data protection regulator CNIL Find software company Next public of France 1.7 million euros over cybersecurity failures that led to a data breach. Regulators said the company knew about security weaknesses before a November 2022 incident that let users access third party documents but didn't fix them until after the breach, which violates GDPR rules. CNIL said the fine reflects the sensitivity of the data, the number of people affected and Next Publica's lack of basic security safeguards. Criminals disconnect wired subscribers from their privacy an extortion group called Lovely has begun leaking subscriber data tied to Conde Nast after claiming the publisher ignored warnings about security flaws. The group published 2.3 million wired subscriber email addresses along with names, home addresses, phone numbers and and account metadata, and says it holds more than 40 million additional records across Conde Nast titles. Researchers from Hudson Rock say the data appears authentic and likely stems from infostealer malware, though no payment card data has surfaced. AFLAC data breach affects millions Aflac said personal data tied to around 22.65 million people was stolen in a June cyber attack on its U.S. systems, including names, addresses, Social Security numbers, government IDs and medical and insurance information. The insurer said the intrusion was part of a broader campaign targeting the insurance industry, did not involve ransomware and has not yet led to known fraud, though affected customers, employees and agents are being offered two years of credit and identity protection. AFLAC Sorry, I had to Romanian energy provider hit by ransomware Romania's largest coal based energy producer, Oltenia Energy Complex, says a ransomware attack over Christmas disrupted its IT systems, encrypting files and knocking erp, email and document management services offline. The Though power generation was apparently not affected, the company is rebuilding systems from backups, assessing whether data was stolen and has reported the incident to national cyber and law enforcement authorities. The attack is attributed to the Gentleman Ransomware Group. If you have thoughts from the news from today or about our show in general, be sure to reach out to [e-mail] we'd really like to hear from you. I am Sarah Lane reporting for the CISO series. Hope you all had a great holiday and we'll talk to you tomorrow.

[A]

Cybersecurity headlines are available every weekday. Head to cisoseries.com for the full stories. Behind the headlines.