Ransomware hits servers at six South Korean firms including hospitals and blocks of flats
From 2022 to July 2025, a ransomware gang encrypted the servers of six South Korean businesses, including hospitals and residential building management offices, paralysing their servers. The attackers broke in by brute-forcing default settings or simple account credentials. The gang's ringleader was arrested in Kazakhstan.
Key facts
- Affected organisation
- Being confirmed
- Incident type
- Ransomware
- Occurred / detected
- Not confirmed
- Scale of damage
- Servers at six South Korean businesses encrypted and paralysed
- Cause / method
- Intrusion by brute-forcing default settings or simple account credentials, followed by server encryption with ransomware
- Location
- South Korea
Timeline
- Investigation findings on a ransomware gang that attacked six South Korean businesses from 2022 to July 2025, and the arrest of its ringleader, were made public.
- The arrest of an international criminal organisation in Kazakhstan came to light.
2 related reports
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.