Ransomware Attack on Gyeongbuk Technopark Disrupts Systems and Encrypts Records
Summary
A ransomware attack on Gyeongbuk Technopark encrypted work records and disrupted systems. Recovery was completed, but some leave and travel records were lost; the organization said no personal information was exposed.
Key points
- The attack occurred in late July and affected resource-management systems.
- The malware encrypted attendance and other records; the attacker reportedly demanded Bitcoin in exchange for decryption.
- The Korea Local Information Research & Development Institute and others helped restore the data.
- Gyeongbuk Technopark said systems were operating normally and no personal information had leaked.
- Some leave and travel records were lost, requiring staff to submit requests again.
- A professor cited in the report said public institutions need more security staffing and budget, warning that underinvestment could allow incidents to recur.
Article Details
- Victim Organization
- Gyeongbuk Technopark
- Incident Type
- Ransomware attack; data in the resource management system and other systems was encrypted.
- Disclosure Date
- 2026-08-31
- Data Types Exposed
- Attendance records
- Leave and business-travel records
- Affected Records
- Unknown
- Affected Data Size
- Unknown
- Operational Impact
- Systems were temporarily unavailable and later restored. Some leave and business-travel records were lost, requiring employees to reapply. Gyeongbuk Technopark said the system was restored and no personal information was leaked.
- Ransom Or Extortion
- The attacker reportedly demanded Bitcoin and other payment in exchange for decryption.
- Claim Status
- confirmed