Cyber Incident Victim: Yes24
Date:
Aug 2025
Location:
South Korea
Summary
Yes24 suffered a ransomware attack that disabled its website and mobile app early in the day, leaving users unable to access books, tickets and other services until the platform was restored by midday. The outage marked the second significant incident in recent months, following a prior breach that had taken several days to resolve. After the earlier attack the firm’s leadership apologized and pledged to overhaul security, increase investment and bring in external experts to strengthen defenses.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Yes24 experienced a ransomware attack early Monday around 4:40 a.m. that disabled user access to its website and app. Users reported being unable to access the site, e‑books and other services from the early morning, with the platform displaying notices citing heavy traffic or technical errors. The outage persisted until approximately 11 a.m., after which the company worked to restore functionality. By 11:30 a.m. Yes24 announced that all services were fully accessible and operating normally.
In June of the same year Yes24’s systems had been paralyzed by a separate ransomware attack, with services gradually resuming over five days. At that time the company delayed informing users and authorities until media reports brought the incident to light. The platform serves 20 million registered users and offers a diverse inventory that includes books, music, stationery and tickets for concerts and theater performances. The repeated outages resulted in prolonged and widespread disruptions for its customer base.
Following the June attack Yes24’s co‑CEOs, Kim Seok‑hwan and Choi Se‑ra, issued a public apology and pledged to overhaul the company’s security measures, increase funding for cybersecurity and bring in outside experts to strengthen defenses. These commitments were reiterated after the August incident as part of the response to restore confidence and improve resilience.