Yes24 Faces Major Disruption Due to Ransomware Attack

Yes24, a leading online bookstore in South Korea with 20 million members, has been experiencing significant service disruptions for two consecutive days following a ransomware attack. The website and app have been rendered inoperable, affecting users' ability to place book orders, check deliveries, access e-books, and manage concert ticket bookings.

On June 10, Yes24 released a statement confirming that the ransomware incident occurred around 4 AM on June 9. Typically, ransomware attacks demand payment for data recovery, but Yes24 has not provided specific details regarding this aspect, nor has the identity of the attackers been disclosed.

Concerns about potential personal data breaches have escalated among users. One customer expressed anxiety on Yes24's Instagram, questioning whether their personal information had been compromised. In response, Yes24 assured that personal and order information is managed separately and has not been leaked. However, users have voiced frustrations, noting issues such as missing e-book purchases and the inability to confirm or cancel concert tickets booked for the week. A subscriber of Yes24's paid e-book service, 크레마클럽 (Crema Club), lamented, "I haven't been able to read any e-books since yesterday, and it's incredibly frustrating." Yes24 stated that they are working on compensation plans for affected customers and will announce specific measures once service is restored.

As the outage continues, questions have arisen regarding whether Yes24 delayed reporting the incident to authorities or failed to seek technical support promptly. Yes24 clarified that they reported the incident to the Korea Internet & Security Agency (KISA) immediately after it occurred, emphasizing that agreeing to technical support from KISA is not mandatory. Companies with their own technical analysis teams can conduct their investigations before KISA's involvement.