Amid ongoing fallout from a major ransomware attack, YES24—one of South Korea’s leading online book and ticket retailers—now faces allegations that it misled the public regarding its data recovery efforts while reportedly paying billions of won in bitcoin to cybercriminals.

According to an exclusive report by JTBC on June 25, YES24’s main services suddenly went offline around 4 a.m. on June 9 following a ransomware cyberattack. Although some functions, such as book and ticket purchases, resumed after five days, several features remain inaccessible as of the end of June.

On June 12, three days into the crisis, YES24 claimed, “Server backups have been completed and restoration is underway.” However, JTBC’s investigation found this statement to be inaccurate. Security experts revealed that YES24 did not properly back up crucial servers containing essential data such as payment records and order information.

As a result, sources indicate YES24 ultimately paid a ransom amounting to billions of won in bitcoin and asked the hackers to decrypt its servers. The payment is believed to have been a last-resort measure after the company was unable to recover lost data through standard backup procedures.

Professor Hwang Seok-jin of Dongguk University’s Graduate School of Information Security commented, “It is never advisable to negotiate with hackers. The fact that YES24 may have compromised, likely due to incomplete recovery, raises significant concerns.”

YES24 also sparked controversy earlier by refusing assistance from technical authorities, despite later claiming to be cooperating with government agencies. The company has since issued a statement saying, “We are re-evaluating our entire security system from the ground up, prompted by this incident.”

This case intensifies calls for governmental intervention, as ransomware attacks become increasingly sophisticated and the cost of response escalates for both private companies and the public sector.

Note “This article was translated from the original Korean version using AI assistance, and subsequently edited by a native-speaking journalist.”

Photo=YES24 website