ENKR

Yes24 ransomware, possible personal-data leak

Add to my breach check

Made public

What leaked4

Hard to replace

  • Mobile number
  • Home or delivery address
  • Username

Permanent

  • Full name

To-dos4 · about 45 min in all

  1. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: phishing messages, scam calls
  2. Register as an exposed person with the FSSabout 10 minLimits harm from: scam calls (opens in a new tab)
  3. Block new loans and cards in your nameabout 10 minLimits harm from: scam calls (opens in a new tab)
  4. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home

What happened next22 events

  1. Undetected 3 events0 days · show events
  2. Response 11 eventsNo individual notice on record · show events
  3. Remedy 3 eventsEnded · show events
  4. Penalty 5 eventsOngoing · show events
  5. DisputesNone on record
  1. Second outage of about seven hours, restored from backup
  2. Second ransomware attack; systems cut off and KISA notified
  3. KISA H1 2025 threat report: services down about five days; no off-site backup, so restored through negotiation with the attacker
  4. Offered all members a KRW 5,000 voucher, plus a free-shipping coupon for recent buyers and a KRW 5,000 eBook voucher for eBook buyers
  5. Apology posted with the first compensation plan
17 more
  1. Ticket holders unable to attend shows on 9-11 June refunded 120% of the ticket price as Yes24 deposit; earlier cancellations got an extra 20%
  2. Ticket cancellation fees waived for bookings made by 10 June and cancelled between 13 and 20 JuneEnded June 20, 2025
  3. Customer notice on possible leak: no leak found at that point, affected items (name, ID, contact, address) to be notified individually if confirmed
  4. Yes24 agreed to KISA technical support
  5. Police cybercrime unit opened a preliminary inquiry
  6. PIPC opened a personal-data leak investigation
  7. Leak report filed with the PIPC citing abnormal member-information lookups
  8. Administrator accounts recovered; service restoration began
  9. MSIT and KISA required Yes24 to preserve and submit incident data
  10. Statement naming ransomware as the cause, with an apology; it said no member data had leaked
  11. Incident reported to KISA
  12. All services (books, tickets, eBook, e-library, Sarak) unavailable
  13. Ransomware intrusion first detected
  14. Intrusion began
  15. Attackers reportedly demanded payment from Yes24
  16. Press reported Yes24 restored its services by paying the attacker cryptocurrency worth several billion won; Yes24 has never said whether this is true
  17. KISA technical-support results (time of report, cause, remedies) sent to Yes24 around autumn 2025; press names unsupported Windows Server 2012 among the causes
Company
Yes24
When it happened
Company detected it
Made public
Notice
Possible leak
Affected
unknown; abnormal member-information lookups reported

How the facts developed

  1. Notice that, if a leak is confirmed, affected customers will be told individually which items leaked, naming name, ID, contact and address (press)
  2. Statement naming ransomware as the cause and saying no member data had leaked (press)

Sources