July: The Month Not Knowing Was the Real Incident

Hi there, Basestone subscriber! 👋

This month brought a particularly sobering story out of Korea: a breach at the Ministry of Foreign Affairs. What was more shocking than the breach itself was that nobody noticed it for nearly ten months. Today we cover this incident along with the rest of July's domestic and international security news 🔐

📌 Quick summary of today's issue

• 🇰🇷 Korea's Ministry of Foreign Affairs had a server compromised through a zero day vulnerability, exposing the personal data of up to 10,000 diplomats and staff, an intrusion that began around April to May last year, was discovered in February this year, and was only disclosed on July 21
• Japan's KDDI suffered a breach affecting roughly 12 million telecom customer records
• SplitVPN, despite marketing a "no-log" policy, was found to have exposed 58 million user connection logs
• Domestic and international ransomware trends: Clop ran a broad campaign exploiting a vulnerability in PTC's software, while Fairlife, a Coca-Cola affiliate, had to halt production lines after a ransomware attack

🔍 What happened

🇰🇷 The Foreign Ministry hack: a breach nobody knew about for ten months

On July 21, Korea's Ministry of Foreign Affairs officially disclosed that the personal data of current and former diplomats and overseas mission staff had been exposed. Attackers exploited a zero day vulnerability that even the software vendor wasn't aware of to access a server running the National Diplomatic Academy's online education system, exposing names, user IDs, emails, encrypted passwords, job titles, and department affiliations. The data reportedly also included information belonging to staff from other agencies, including National Intelligence Service agents and Ministry of Defense attaches. Fortunately, more sensitive data like resident registration numbers, phone numbers, and addresses were not among the exposed items.

What stands out most in this incident is the timeline. Attackers had reportedly compromised the server around April to May of last year and accessed it repeatedly over roughly ten months. The Ministry first identified signs of the breach this past February, but the public disclosure didn't come until five months later, on July 21. The Ministry explained this was because "the system and institution in question are not unrelated to national security," but the fact that disclosure was delayed for five months even after detection made it hard to avoid criticism of a slow response.

Japan's KDDI: a breach affecting roughly 12 million telecom customer records

On July 8, it was confirmed that Japanese telecom giant KDDI suffered a breach affecting roughly 12 million customer records. Given the nature of the data a telecom carrier holds, an incident like this inevitably carries a large scale and broad impact. That same day, Accenture also disclosed a breach involving stolen data that included source code, part of a wave of major corporate breach disclosures in early July.

The VPN provider that promised "no logs" and leaked logs anyway

The SplitVPN incident disclosed on July 29 is a case study in irony. This was a VPN service that had marketed a "no-log" policy, promising not to retain connection records, yet it turned out that as many as 58 million user connection logs had been left exposed. It's a reminder that for services built around privacy as a core value proposition, like VPNs, it's especially hard to verify whether actual operations match the promise.

Ransomware and credential theft, the same patterns keep repeating

In July, the ransomware group Clop ran a wide-reaching campaign exploiting vulnerabilities in PTC's Windchill and FlexPLM software, and Coca-Cola affiliated dairy company Fairlife had to halt production line operations after a ransomware attack. Swiss rail manufacturer Stadler Rail was hit with a roughly 123 million dollar ransom demand from the Anubis ransomware group but refused to pay. Fast food chain Chick-fil-A also saw about 13,000 customer accounts accessed without authorization through a credential stuffing attack, and accounting and consulting firm EY had employee data stolen after the ShinyHunters group breached a third party platform.

🧭 Why this matters now

How long it takes to know about a breach shapes how severe it actually is

Looking only at what was exposed in the Foreign Ministry incident, names, emails, job titles, it might seem relatively limited. But add in a ten month intrusion window and a five month disclosure delay, and the picture changes entirely. How sensitive the exposed data is matters, but how quickly a breach is actually noticed matters just as much in determining its real severity.

Policy and actual operations are two different things

The SplitVPN no-log case offers a useful lesson: what a policy document says and how a system actually behaves are separate questions. This is especially true for services that build their value proposition around privacy or security. Those promises need to be periodically verified against the actual architecture and log management practices behind them.

A single vulnerability in a software supply chain can spread to widespread damage

As with Clop's attack on PTC's software, a structure where one vulnerability in a single piece of software spreads damage to every customer using that software keeps repeating itself. Regularly reviewing the supply chain risk of the software your organization depends on is becoming more important by the month.

✅ Four things to check after this month's incidents

• Do you know your average detection time — has your detection system ever caught an anomaly that had actually been sitting there for months before you found it
• Have you actually simulated the time it takes from identifying a breach through internal reporting, executive reporting, and external disclosure (a 24-hour statutory deadline for bodies like KISA)
• If you use external services that build their core value around privacy or security (VPN, cloud storage, and similar), have you recently verified that their policy documents match how they actually operate
• Using a recent real example, have you checked how quickly (same day, within a week, within a month) you identify and patch CVE advisories for software your critical operations depend on

⚠️ What teams often miss

Older systems tend to fall outside monitoring's reach

The system at the root of the Foreign Ministry breach was an online education platform, an area that typically gets less attention than core operational systems. But to an attacker, it's simply another door into the organization. This is exactly why systems that seem lower priority still need to be included under the same level of monitoring.

A delayed disclosure isn't always accepted as reasonable

Sometimes disclosure is delayed for sensitive reasons like national security, but when that judgment is made entirely internally without being explained externally, it tends to turn into a trust problem. If a delay is genuinely unavoidable, having the reasoning and criteria worked out in advance puts an organization in a far better position when responding to an actual incident.

"The severity of a breach is measured less by what was exposed and more by how long it took to notice." — Basestone Security Research Team

🚀 How to start small

A good first step is pulling together a list of the systems in your organization that get relatively little attention. Online education platforms, internal portals, and older collaboration tools, the systems that seem "unimportant," are exactly where monitoring gaps are most likely to exist.

If you'd like to look back at last month's incidents around authentication and access control, we'd also recommend reading How Static Credentials and Neglected Access Rights Drove June's Security Incidents.