According to BleepingComputer, South Korean education group Kyowon confirmed a ransomware attack in which data was exfiltrated and is investigating with authorities whether customer information was included [1]. According to Yonhap, eight Kyowon affiliates reported signs of a leak to the Personal Information Protection Commission, which opened a probe, and a government team estimates about 9.6 million accounts may be affected [3][2]. Kyowon customers should watch for the company's follow-up notice, as it says it will disclose details if a customer data leak is confirmed [1].
This event has not been officially confirmed. Content is based on media or third-party reports.
Backfill: this event became public on Jan 12, 2026 and we added it on Nov 11, 2026. It is not a new event.
HighMonitoringBackfillMedia reported
South Korea's Kyowon Group hit by ransomware; data exfiltrated from eight affiliates, about 9.6 million accounts at risk
1 min read
- Disclosed
- Jan 12, 2026
- Occurred
- Jan 10, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 11, 2026
- Scale
- 9,600,000 accounts[2]
- CVSS basis
- Our assessment
- Attack vector
- Unknown
- Actor type
- Ransomware group
- Motivation
- Unknown
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Education
What to do nowOur advice
- Watch for Kyowon's notice once it confirms whether customer data was involved [1].
Timeline
Technical details
Remediation
Vendor guidance
- 1Watch for company notices verify[1]
Watch for Kyowon's follow-up notice on whether customer data was included.
References
Media3
- [1]BleepingComputer2026-01-13Accessed 2026-11-11Snapshot 2026-11-11 sha256 83198b8404cf
“In a subsequent update today, Kyowon confirmed the ransomware incident, disclosing that it occurred on January, around 10 a.m., and that the attacker exfiltrated customer data.”
- [2]Yonhap News Agency2026-01-14Accessed 2026-11-11Snapshot 2026-11-11 sha256 922888d81650
“South Korean cybersecurity authorities estimate that around 9.6 million accounts may have been affected by a recent cyberattack at Kyowon Group, a local education service provider, informed sources said Wednesday.”
- [3]연합뉴스2026-01-13Accessed 2026-11-11Snapshot 2026-11-11 sha256 979feab14f80
“개인정보보호위원회는 13일 오전 9시께 교원그룹 8개사의 개인정보 유출신고가 접수됨에 따라 개인정보 유출 조사에 착수했다고 밝혔다.”
Expert help
Still not sure whether this affects you?
Tell us about your environment. We'll check it against this advisory, assess the risk, and give you concrete patch and monitoring steps.
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.