YES24 security incident history
Hacking, data breaches and other security incidents involving YES24, with related coverage.
YES24 hit by ransomware again, all services go offline
Impact: Access to all services suspended for about 7 hours
YES24 was hit by a ransomware attack at around 4.30am on 11 August 2025, cutting off access to all of its services. In an attack that followed the June incident, YES24 urgently shut down its systems and restored from backups. Services returned to normal at around 11.20am the same day, and the Korea Internet & Security Agency (KISA) launched an on-site investigation.
Related reports: 15 · last report →YES24 ransomware infection halts book sales and ticket bookings
Impact: Website and app access and book purchases and ticket bookings halted; miscellaneous losses of 4.8 billion won
YES24 was infected with ransomware on 9 June 2025, cutting off access to its website and app and disrupting book purchases and performance ticket bookings. The company said its initial investigation had found no signs of major data leakage or loss, and police and the Personal Information Protection Commission (PIPC) launched investigations. After resuming some services, the company announced a compensation plan for all members, and it later emerged that it had paid the hackers in bitcoin and that its backup network had also been infected.
Related reports: 29 · last report →