Now Hacked
EN-GB
Ransomware

YES24 ransomware infection halts book sales and ticket bookings

First reported · Last reported · 29 related reports

YES24 was infected with ransomware on 9 June 2025, cutting off access to its website and app and disrupting book purchases and performance ticket bookings. The company said its initial investigation had found no signs of major data leakage or loss, and police and the Personal Information Protection Commission (PIPC) launched investigations. After resuming some services, the company announced a compensation plan for all members, and it later emerged that it had paid the hackers in bitcoin and that its backup network had also been infected.

Key facts

Affected organisation
YES24
Incident type
Ransomware
Occurred / detected
2025-06-09
Scale of damage
Website and app access and book purchases and ticket bookings halted; miscellaneous losses of 4.8 billion won
Cause / method
Ransomware infection, including infection of the backup network
Location
South Korea

Timeline

  1. Access to the website and app was cut off due to a ransomware infection.
  2. Police and the Personal Information Protection Commission launched investigations, and the company said no signs of major data leakage or loss had been found.
  3. A second compensation plan was announced, providing all members with 5,000-won vouchers and other benefits.
  4. It emerged that the company had resolved the incident by paying the hackers in bitcoin.
  5. It emerged that the backup network had also been infected with ransomware at the time of the first hack.
  6. Miscellaneous losses of 4.8 billion won related to the hacking damage came to light.

29 related reports

  • RansomwareYES24

    YES24 hit by ransomware again, all services go offline

    Impact: Access to all services suspended for about 7 hours

    YES24 was hit by a ransomware attack at around 4.30am on 11 August 2025, cutting off access to all of its services. In an attack that followed the June incident, YES24 urgently shut down its systems and restored from backups. Services returned to normal at around 11.20am the same day, and the Korea Internet & Security Agency (KISA) launched an on-site investigation.

    Related reports: 15 · last report →

The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.