Ransomware hits servers at six South Korean firms including hospitals and apartment complexes
From 2022 to July 2025, a ransomware gang encrypted the servers of six South Korean businesses, including hospitals and apartment management offices, paralyzing their servers. The attackers broke in by brute-forcing default settings or simple account credentials. The gang's ringleader was arrested in Kazakhstan.
Key facts
- Affected organization
- Being confirmed
- Incident type
- Ransomware
- Occurred / detected
- Not confirmed
- Scale of damage
- Servers at six South Korean businesses encrypted and paralyzed
- Cause / method
- Intrusion by brute-forcing default settings or simple account credentials, followed by server encryption with ransomware
- Location
- South Korea
Timeline
- Investigation findings on a ransomware gang that attacked six South Korean businesses from 2022 to July 2025, and the arrest of its ringleader, were made public.
- The arrest of an international criminal organization in Kazakhstan came to light.
2 related reports
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.