YES24 hit by ransomware again, all services go offline
YES24 was hit by a ransomware attack at around 4:30 a.m. on August 11, 2025, cutting off access to all of its services. In an attack that followed the June incident, YES24 urgently shut down its systems and restored from backups. Services returned to normal at around 11:20 a.m. the same day, and the Korea Internet & Security Agency (KISA) launched an on-site investigation.
Key facts
- Affected organization
- YES24
- Incident type
- Ransomware
- Occurred / detected
- 2025-08-11
- Scale of damage
- Access to all services suspended for about 7 hours
- Cause / method
- Ransomware attack
- Location
- South Korea
Timeline
- At around 4:30 a.m., a ransomware attack cut off access to all services, and the systems were urgently shut down.
- After restoration from backups, services returned to normal at around 11:20 a.m., and the Korea Internet & Security Agency (KISA) launched an on-site investigation.
15 related reports
- SKT 해킹부터 예스24·SGI 먹통까지… 올 상반기 ‘침해사고’ 신고 1000건 돌파
- '랜섬웨어 해킹' 예스24, 두 달만에 또 먹통..."시스템 원천 차단"
- 예스24, 랜섬웨어 공격 7시간 만에 복구…"서비스 정상화"
- 예스24, 두 달 만에 또 먹통…“랜섬웨어 해킹”
- 예스24, 두 달 만에 또 먹통···“랜섬웨어 공격받아 서비스 차단하고 복구 중”
- 예스24, 랜섬웨어 재공격에 서비스 중단…“해킹 두 달 만에 또다시 먹통”
- 예스24 해킹 두달 만에 또 먹통…"접속자 많거나 오류로 장애"(종합)
- 예스24 또 해킹 논란 “소 잃고 외양간 안 고쳤나”
- 예스24, '해킹 맛집' 오명…왜 또 먹통됐나
- 랜섬웨어에 두번 당한 예스24…"해커 먹잇감 됐다"
- “또 먹통이네”... 두 달 전 해킹당한 예스24 접속 오류 “원인 파악 중”
- 예스24, 두달 만에 또 랜섬웨어 공격...“시스템 긴급 차단 후 복구 중”
- 예스24는 랜섬웨어에 왜 또 당했나?
- 예스24·SGI 이어 웰컴금융그룹도 해킹 공격…내부정보 일부 유출 확인
- 예스24·SGI 이어 웰컴금융에도 해킹 공격…내부정보 유출 확인
Other incidents at YES24
YES24 ransomware infection halts book sales and ticket bookings
Impact: Website and app access and book purchases and ticket bookings halted; miscellaneous losses of 4.8 billion won
YES24 was infected with ransomware on June 9, 2025, cutting off access to its website and app and disrupting book purchases and performance ticket bookings. The company said its initial investigation had found no signs of major data leakage or loss, and police and the Personal Information Protection Commission (PIPC) launched investigations. After resuming some services, the company announced a compensation plan for all members, and it later emerged that it had paid the hackers in bitcoin and that its backup network had also been infected.
Related reports: 29 · last report →
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.