{"id":"kyowon-ransomware-service-disruption-jan-2026","category":"breach","status":"closed","title":"Kyowon ransomware disrupts education and consumer services; customer-data exposure unresolved","tldr":"Ransomware disrupted South Korea's Kyowon Group on 10 January. Most website functions returned by 14 January, but customer-data exposure remained unresolved in the latest follow-up found. Customers should check official notices and verify unexpected messages.","summary":"Ransomware struck South Korea's Kyowon Group on 10 January, disrupting education and consumer services after the company disconnected its internal network. Kyowon identified signs of an external data leak on 12 January. BleepingComputer described confirmed data theft, while Kyowon's statement said investigators had not established whether customer information was included. Yonhap reported that around 9.6 million accounts might be affected, rather than confirming that many stolen records; customers could hold multiple accounts. Server figures also differed: Yonhap reported 600 of 800 within the breach's scope, while Maeil Business Newspaper attributed about 300 infected servers to Kyowon. Precautionary customer messages began on 13 January. By 14 January, Kyowon said most website access and key functions were restored, with recovery nearing completion. The latest follow-up found, dated 17 January, still described an unresolved personal-data investigation. No later public conclusion, confirmation of complete recovery, ransom outcome or charges was located through 3 November 2026.","action":"If your family uses Kyowon services, check the relevant service's official website or contact its usual customer-support number for any notice about your account. Verify unexpected messages or calls independently before sharing information or making payments. There is no customer software update identified for this company-side incident.","product":"Kyowon Group education and consumer services in South Korea","audience":"home","severity":"high","patch":"na","exploited":true,"cves":[],"tags":["kyowon","ransomware","south-korea","education","service-disruption","data-breach"],"affected":[],"fixed":[],"matches":[],"sources":[{"kind":"advisory","title":"Kyowon begins customer notifications about data-leak signs; customer-information investigation continues","url":"https://www.kyowon.co.kr/Media/News_detail?iscont=&nttid=1257&page=1&searchcolumn=&searchpreface=+&searchpreface2=&searchpreface3=&searchword=","by":"Kyowon Group","date":"2026-01-14"},{"kind":"advisory","title":"Kyowon identifies signs of a data leak and submits an additional report to KISA","url":"https://www.kyowon.co.kr/Media/News_detail?iscont=&nttId=1256&searchword=","by":"Kyowon Group","date":"2026-01-13"},{"kind":"news","title":"South Korean giant Kyowon confirms data theft in ransomware attack","url":"https://www.bleepingcomputer.com/news/security/south-korean-giant-kyowon-confirms-data-theft-in-ransomware-attack/","by":"BleepingComputer","date":"2026-01-14"},{"kind":"news","title":"Cyberattack at Kyowon exposes over 9 million user accounts to possible breach: Sources","url":"https://koreajoongangdaily.joins.com/news/2026-01-14/national/socialAffairs/Cyberattack-at-Kyowon-exposes-over-9-million-user-accounts-to-possible-breach-Sources/2500131","by":"Yonhap via Korea JoongAng Daily","date":"2026-01-14"},{"kind":"news","title":"Kyowon ransomware investigation: about 300 servers affected; customer-data leak still being checked","url":"https://www.mk.co.kr/en/economy/11932874","by":"Maeil Business Newspaper","date":"2026-01-14"},{"kind":"news","title":"Kyowon Hack Investigation Continues Week Later; Data Breach Status Unclear","url":"https://en.sedaily.com/finance/2026/01/17/kyowon-hack-investigation-continues-week-later-data-breach","by":"Seoul Economic Daily","date":"2026-01-17"}],"started":"2026-01-10","closed":"2026-01-17","created":"2026-11-03T21:20:23.280Z","updated":"2026-11-03T21:20:23.280Z","cve_notes":[],"timeline":[{"at":"2026-01-17","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"Seoul Economic Daily reported that investigators were still determining the extent of the incident and whether personal information had leaked. Kyowon said forensic analysis could take time and promised further customer notices if exposure was confirmed.","url":"https://en.sedaily.com/finance/2026/01/17/kyowon-hack-investigation-continues-week-later-data-breach","by":"Seoul Economic Daily","patch":null},{"at":"2026-01-14","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"Maeil Business Newspaper separately attributed a lower figure of about 300 infected servers out of 800 to Kyowon. Its report also said customer-data exposure remained unconfirmed.","url":"https://www.mk.co.kr/en/economy/11932874","by":"Maeil Business Newspaper","patch":null},{"at":"2026-01-14","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"Yonhap reported investigators' estimates that 600 of 800 servers fell within the breach's scope and around 9.6 million accounts might be affected. Neither figure established how many customers' records were stolen.","url":"https://koreajoongangdaily.joins.com/news/2026-01-14/national/socialAffairs/Cyberattack-at-Kyowon-exposes-over-9-million-user-accounts-to-possible-breach-Sources/2500131","by":"Yonhap via Korea JoongAng Daily","patch":null},{"at":"2026-01-14","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"Kyowon said most website access and key functions were operating normally after restoration began on 12 January. Overall website and online-service recovery was nearing completion.","url":"https://www.kyowon.co.kr/Media/News_detail?iscont=&nttid=1257&page=1&searchcolumn=&searchpreface=+&searchpreface2=&searchpreface3=&searchword=","by":"Kyowon Group","patch":null},{"at":"2026-01-13","added":"2026-11-03T21:16:05.524Z","kind":"disclosed","text":"Kyowon reported the data-leak signs to the Korea Internet & Security Agency and began sending customers precautionary notices by text message and KakaoTalk.","url":"https://www.kyowon.co.kr/Media/News_detail?iscont=&nttid=1257&page=1&searchcolumn=&searchpreface=+&searchpreface2=&searchpreface3=&searchword=","by":"Kyowon Group","patch":null},{"at":"2026-01-12","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"Kyowon identified signs that data had left its systems. The amount involved and whether it included customer information remained under investigation.","url":"https://www.kyowon.co.kr/Media/News_detail?iscont=&nttId=1256&searchword=","by":"Kyowon Group","patch":null},{"at":"2026-01-10","added":"2026-11-03T21:16:05.524Z","kind":"other","text":"Kyowon detected the ransomware incident at about 8 am South Korean time. It disconnected its internal network and temporarily suspended website access.","url":"https://www.kyowon.co.kr/Media/News_detail?iscont=&nttid=1257&page=1&searchcolumn=&searchpreface=+&searchpreface2=&searchpreface3=&searchword=","by":"Kyowon Group","patch":"na"}],"url":"https://hard.fyi/live/kyowon-ransomware-service-disruption-jan-2026/","json":"https://hard.fyi/api/live?id=kyowon-ransomware-service-disruption-jan-2026"}