A ransomware attack disrupted operations at South Korean conglomerate Kyowon

A ransomware attack disrupted operations at South Korean conglomerate Kyowon, with the company saying most of its core subsidiaries were affected and extortion attempts followed the infection. Kyowon detected abnormal activity on Saturday, January 10, triggering an emergency response that isolated affected servers to prevent further compromise.

According to the incident report filed with the Korea Internet & Security Agency (KISA) and obtained by The Asia Business Daily, the attacker exploited an open external port to infiltrate Kyowon’s network and spread laterally across subsidiaries. Kyowon Group, in a statement released on the morning of January 12, said they were still checking whether any personal information had been leaked and would notify customers promptly if a data breach is confirmed.

Authorities estimate that around 9.6 million accounts may have been impacted, and about 600 of Kyowon’s 800 servers fall within the scope of the breach, according to Korea Joongang Daily. At the time of writing, no major ransomware group had claimed responsibility.