The IT network of Kyowon Group, which operates businesses such as Red Pen, Kumon, funeral services, and travel, has suffered a ransomware attack.

Kyowon Group has millions of members across its various affiliates. In particular, its learning material businesses, Kyowon and Kyowon Kumon, hold not only the personal information of children and parents but also sensitive data such as credit card or bank account numbers required for tuition payments. If a personal information breach is confirmed, significant disruption is expected.

원본보기 아이콘

According to The Asia Business Daily's coverage on January 12, Kyowon Group suffered a ransomware attack in the early morning of January 10, resulting in website access issues and internal system errors across all affiliates. According to the incident report obtained from the Korea Internet & Security Agency (KISA) by The Asia Business Daily, the attack involved an external server exposed to the internet, through which the attacker infiltrated the internal systems and spread ransomware infection throughout the affiliates.

The report details that the attacker used a server with an open external port as a foothold to further penetrate the internal systems, moving through the network connecting affiliates and causing the damage to spread group-wide. During this process, disruptions occurred in accessing key services and internal databases (DB).

The companies that reported the incident to KISA include Kyowon, Kyowon Kumon, Kyowon Wiz, Kyowon Life, Kyowon Tour, Kyowon Property, Kyowon Healthcare, and Kyowon Start One, encompassing most of Kyowon Group's core affiliates.

The report also specifies that there was extortion activity following the ransomware infection, although no police report has been filed yet.

Due to this hacking incident, most of Kyowon Group's IT networks, including its internal authentication and management system KSS (Kyowon Super Star), have been blocked and are currently unavailable. As of the morning of January 12, notices stating "Web service is not available due to unexpected disruptions" were posted on the websites of Kyowon Group and several affiliates.

Service Disruption Notice on Kyowon Group Website. Screenshot of Kyowon Group Website.

원본보기 아이콘

Kyowon Group is currently working to restore its systems using backup data and is conducting a detailed analysis to determine whether there has been any additional damage. KISA has also provided on-site technical support over the weekend. Lee Donggeun, Director of Digital Threat Response at KISA, told The Asia Business Daily, "At this point, we do not expect the damage to spread significantly. However, since system recovery takes time when disruptions occur, we will need to wait a bit longer to fully assess the situation."

In an official statement released on the morning of January 12, Kyowon Group said, "At around 8 a.m. on January 10, we detected suspicious signs of an external cyber intrusion, presumed to be ransomware. Immediately after recognizing the incident, we reported the situation to KISA and relevant investigative authorities, and we are working with external security experts to thoroughly analyze the cause and extent of the damage." The company added, "We are currently verifying whether any personal information has been leaked. If a breach is confirmed through the investigation, we will promptly and transparently notify customers in accordance with relevant laws and procedures, and swiftly implement the necessary protection measures."

Kyowon Group has affiliates in various sectors, including funeral services (Kyowon Life), learning materials (Kyowon and Kyowon Kumon), rental services (Kyowon Invest), and travel (Kyowon Travel). As a result, the company holds not only the personal information of members of all ages, but also vast amounts of sensitive data such as years of learning history for children and adolescents, as well as travel and accommodation information. Concerns about the leakage of children's information are already growing among parents in online communities and mom cafes.

So far, there is no evidence of personal information leakage, and no report has been filed with the Personal Information Protection Commission.

However, since learning material companies such as Kumon and Red Pen hold large amounts of personal information of students and parents, the industry points out that the possibility of leakage cannot be completely ruled out.

A Kyowon Group representative stated, "We sincerely apologize for the concern this incident has caused our customers. Experts are currently working to restore systems quickly and verify data integrity, and we will do our utmost to prevent a recurrence in the future."