A ransomware attack disrupted operations at South Korean conglomerate Kyowon

Kyowon Group confirmed a ransomware intrusion detected on January 10 that disrupted services across core subsidiaries, infected an estimated 600 of 800 servers, and may have exposed up to 9.6 million user accounts; the attacker leveraged an exposed external port to gain access, move laterally, and deploy ransomware, and investigators including KISA and external cybersecurity experts are assessing the impact and data breach scope.