South Korean police say a suspected hacker breached 60 organizations and stole personal and business data, then used the threat of public disclosure to demand payment. The group reportedly sent extortion emails and escalated to calls and text messages to executives and employees when organizations did not comply. The reported campaign affected businesses, hospitals, and educational institutions.
South Korean police allege that a suspected hacker breached 60 organizations over a 44-day span, compromising more than 8.2 million personal-information records across the broader campaign. The stolen data reportedly included resident registration numbers, contact details, employee records, internal documents, patient consultation details, and information about minors. Rather than deploying ransomware to encrypt systems, the group allegedly used the theft itself as leverage, threatening to publicly disclose the data unless organizations paid.
According to the reporting, extortion emails targeted 38 organizations and sought a combined 360 million won. These messages warned recipients that disclosure could damage their reputations and lead to regulatory penalties or customer lawsuits. When organizations did not comply, accomplices reportedly escalated by contacting executives and employees directly through phone calls and text messages. This multi-channel pressure, moving from email to vishing and smishing, was designed to increase urgency and bypass any single point of resistance within a targeted organization.
Data-theft extortion works differently than ransomware. Because no systems are encrypted, there is no outage to immediately signal an incident, and the threat instead centers on reputational harm, regulatory exposure, and potential lawsuits. Only one organization was confirmed to have paid, but the threat of disclosure alone can create pressure, especially when accomplices follow up through unexpected calls and texts to individual employees rather than through formal organizational channels.
Organizations across sectors, including healthcare, education, and general business, should prepare for this kind of extortion rather than only accounting for traditional ransomware. Practical steps include:
Because this campaign combined email, vishing, and smishing (see T1566), awareness training should cover all three channels together rather than treating them as separate threats.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
A suspected hacker allegedly breached 60 South Korean organizations and stole personal and business data, then sent extortion emails threatening public disclosure unless payment was made.
Police allege that when organizations did not comply with the email demands, accomplices followed up with phone calls and text messages to executives and employees.
No, this was data-theft extortion rather than encryption-based ransomware. Only one organization was confirmed to have paid.
The reported campaign affected businesses, hospitals, and educational institutions, among other organizations.
“We have your records. Pay, or we’ll publish them.” That’s data-theft extortion, not ransomware. In South Korea, extortion emails hit 38 organizations. When recipients didn’t comply, calls and texts reached executives and employees. Here’s the tell: the pressure changes channels, but the demand stays the same. A caller claiming to have employee or patient records isn’t proof, and paying won’t erase stolen copies. Get that email, call, or text? Report it immediately through your company’s security incident channel.
Researchers uncovered exposed infrastructure allegedly used by affiliates of INC Ransomware and The Gentlemen Ransomware. Alongside device exploits and ransomware tooling, the records describe a practical extortion workflow: direct emails to owners or executives, followed by voice calls, pressure…
Researchers say criminals are using a two-part Android malware setup (SpyNote + WindRelay) to trick victims into turning their own phones into NFC “relays” for contactless payment fraud. Victims are lured via phishing/smishing/vishing to install a malicious app, then persuaded on a live call to tap…
Dutch police are investigating ShinyHunters after a phone-based social engineering incident helped attackers break into Odido, the Netherlands’ largest mobile provider. Investigators say the caller persuaded an employee to log into a spoofed website, which was then used to steal data on more than…
Arctic Wolf reports a wave of phone-based social engineering where attackers pose as internal IT, guide executives through “routine” MFA/passkey setup, and then send a company-branded login link that steals Microsoft 365 credentials and session tokens. Once inside, attackers methodically inventory…
ASOS confirmed attackers got into customer-data systems after tricking an employee into handing over login credentials. Stolen data reportedly included not only names and contact details, but also customers’ shopping searches, which could enable highly convincing follow-on scams and phishing.…
Researchers say the BlackFile extortion group is actively targeting large financial and other organizations using voice-phishing calls where attackers impersonate IT support to get initial access. Victims are then pressured with multimillion-dollar extortion demands and, in some cases, escalations…
