ENKR

Yes24 ransomware, possible personal-data leak

Add to my breach check

Made public

What leaked4

Hard to replace

  • Mobile number
  • Home or delivery address
  • Username

Permanent

  • Full name

To-dos4 · about 45 min in all

  1. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: phishing messages, scam calls
  2. Register as an exposed person with the FSSabout 10 minLimits harm from: scam calls (opens in a new tab)
  3. Block new loans and cards in your nameabout 10 minLimits harm from: scam calls (opens in a new tab)
  4. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home

What happened next22 events

  1. Undetected 3 events0 days · show events
  2. Response 11 eventsNo individual notice on record · Back to latest
  3. Remedy 3 eventsEnded · show events
  4. Penalty 5 eventsOngoing · show events
  5. DisputesNone on record

Response: 11 events

Back to latest
  1. Second outage of about seven hours, restored from backup
  2. Second ransomware attack; systems cut off and KISA notified
  3. Apology posted with the first compensation plan
  4. Customer notice on possible leak: no leak found at that point, affected items (name, ID, contact, address) to be notified individually if confirmed
  5. Leak report filed with the PIPC citing abnormal member-information lookups
6 more
  1. Administrator accounts recovered; service restoration began
  2. Statement naming ransomware as the cause, with an apology; it said no member data had leaked
  3. Incident reported to KISA
  4. All services (books, tickets, eBook, e-library, Sarak) unavailable
  5. Press reported Yes24 restored its services by paying the attacker cryptocurrency worth several billion won; Yes24 has never said whether this is true
  6. KISA technical-support results (time of report, cause, remedies) sent to Yes24 around autumn 2025; press names unsupported Windows Server 2012 among the causes
Company
Yes24
When it happened
Company detected it
Made public
Notice
Possible leak
Affected
unknown; abnormal member-information lookups reported

How the facts developed

  1. Notice that, if a leak is confirmed, affected customers will be told individually which items leaked, naming name, ID, contact and address (press)
  2. Statement naming ransomware as the cause and saying no member data had leaked (press)

Sources