2026 South Korea NHIS — feijo dark-forums 48M record sale claim (unverified)
Data compromised
Advertised (unverified): names, Resident Registration Numbers (RRNs), gender, DOB, insurance subscriber class, employer, household IDs, monthly income/premium fields, last checkup dates, long-term care grades, payment arrears — per forum sample
Technical writeup
Unverified leak-site / underground sale claim — August 16–19, 2026. Threat intelligence and Dark Web Informer–style monitors flagged a darkforums.ru listing by an actor using the alias feijo offering approximately 48 million records allegedly from South Korea’s National Health Insurance Service (NHIS, nhis.or.kr) for about $450 USD, with Telegram contact and published sample rows. Advertised fields include full names, highly sensitive Resident Registration Numbers (RRNs), gender, dates of birth, insurance classifications, employer details, household identifiers, monthly income and premium data, last health-checkup dates, and long-term care grades. Brinztech and Nostr reposts summarize the claim; NHIS had not issued a public breach confirmation at indexing, and experts note data could originate from aggregation, older leaks, or mislabeling — treat counts and victim attribution as unverified. recordsAffected 48000000 reflects the actor’s advertised record count only (unverified). Update if NHIS or Korean regulators confirm.
Root cause
Unverified underground sale listing — actor alias feijo on darkforums.ru (~Aug 16, 2026); NHIS had not confirmed a breach at indexing