K-pop fans caught up in Yes24 ransomware attack, ticket platform down, events canceled

Even the K-Pop world can’t hide from ransomware as South Korea’s leading ticketing platform, Yes24, was hit with a major attack on Monday – reportedly triggering chaos for music fans and the nation’s entire entertainment industry.

Yes24, an “internet-based book, music CD, and ticket distributor” geared towards K-pop fans with over 20 million registered users, said it first became aware of the attack on Monday, June 9th, around 4:00 a.m. local time.

According to The Korea Herald, “Yes24’s website and mobile app have been inaccessible since early Monday.”

Yes24 officials told the news outlet the attack had “disabled the company’s main and backup servers,” and that “critical internal files used to control system operations were targeted in the hack.”

“We are currently working to determine the exact cause of the disruption and the extent of the damage,” the Seoul-based company said in a statement released earlier this week.

Customer data at risk

Addressing fears of a data leak on Thursday, Yes24 posted an updated notice on the landing page of its website, which is still not operational, telling customers, “As far as we have determined so far, we have not confirmed any external leakage of personal information.”

Noting that the attack was carried out by an “unidentified person,” the K-pop media house said that if the investigation determines otherwise, customers will be “contacted individually.”

Since the initial breach, the online media retailer said it was able to “successfully recover the administrator account and are currently working to normalize the service” and that it expects "full recovery by Sunday."

Yes24 said that immediately following the incident, it had implemented enhanced security measures and reported the matter to the relevant authorities, including the Korea Internet & Security Agency, but some have slammed the company for waiting over 36 hours to disclose the breach, The Herald reports.

Apparently, Yes24 initially attributed the outage to "system maintenance,” leaving millions of fans in the dark.

K-pop fans left scrambling

The four-day outage has triggered massive disruptions across the entertainment industry, according to the Korean news outlet.

Popular K-pop boy band Enhypen was forced to cancel a fan signing event to promote a new album release, and the "Beautiful Mint Life" music festival, scheduled to take place this weekend in Seoul, is dealing with thousands of ticket holders unable to access their reservations.

Presale ticketing has also reportedly been postponed for several other prominent K-pop artists, including the boy band Ateez, the rapper B.I., and heartthrob actor and singer Park Bo-gum.

For concerts and musical theatre productions still being held, fans have been instructed to bring hard copies of their tickets, with many reportedly being turned away at the door without proof of reservations.

Yes24 has said it will be posting information about refunds for cancelled events and compensation for unused tickets in the coming days.

Meantime, the company is warning customers to be on alert for phishing attacks, including through text messages, emails, and phone calls claiming to be from Yes24 or financial institutions.

“Do not click on links or attachments from unclear sources and delete them immediately,” it said, also urging customers to change their passwords and check their accounts for any unauthorized transactions.