Yes24 Reports Ransomware Attack Around 4 a.m. ... Shuts Down System for Security

Yes24 Hit by Ransomware Attack
System Shut Down Early Morning on the 11th for Security
"No Issues Expected with Data Recovery from Backups"

Yes24, the largest online bookstore in South Korea, has suffered another ransomware attack just over two months after a previous hacking incident, resulting in a complete suspension of its services.

According to Yes24, the ransomware attack occurred at around 4:30 a.m. on August 11. A Yes24 representative stated, "As soon as we identified the ransomware attack, we immediately shut down the entire system for security reasons," adding, "There are no issues with the backup system, so there should be no problem with data recovery."

Due to this incident, users experienced service disruptions from the morning of August 11, causing significant inconvenience. Systems used by publishers to track inventory were also affected, leading to further difficulties.

Previously, on June 9 of this year, Yes24 was hit by a ransomware hacking attack that paralyzed its app and online network. Services began to be gradually restored on June 13, five days after the initial outage.

At that time, Yes24 did not immediately inform users or the public of the hacking incident. The company only disclosed the breach after it was reported the following day that Yes24 had notified the Korea Internet & Security Agency (KISA) and other authorities of the attack.

With approximately 20 million members, Yes24 is the largest online bookstore in South Korea, offering not only books but also music albums, DVDs, and stationery. It also serves as a platform for trading various performance tickets, so the service suspension has had a significant impact.