GSG声称窃取Nexon数据但未给证据，SK电讯同类数据售卖帖已被否认

이전 기사보기
다음 기사보기
Ransomware Group Claims Data Theft From Nexon, Authenticity Under Scrutiny
Character Size Settings
가
The body content of the article will be changed to this letter size.
스크롤 이동 상태바
IT·Gaming
Newly emerged GSG claims attack on Nexon as separate post offers alleged SK Telecom subscriber data for sale
KimSeonghun
Published 2026.07.28 08:46
Reply 0
이 기사를 공유합니다
A post by Global Secret Group (GSG) listing Nexon Korea Corp. on its dark web leak platform. (Photo: Ransomware Live)
A series of claims alleging data theft targeting Nexon Korea and SK Telecom has surfaced on the dark web, drawing scrutiny over the authenticity of the claims. One claim alleges the theft of 4.2 terabytes (TB) of Nexon data, while another asserts possession of approximately 26 million SK Telecom subscriber records.
Dark web search results for "Nexon" on the GSG site. (Photo: GSG website)
According to cybersecurity industry sources on July 27, a ransomware threat group calling itself the Global Secret Group (GSG) claimed at around 3:00 a.m. KST on July 27 that it had breached approximately 30 organizations, including Nexon Korea.
​GSG stated that it exfiltrated 24,891 files totaling 4.2 TB from Nexon Korea. However, the group did not publish sample files, proof-of-concept data, or internal directories to substantiate what information was allegedly compromised.
​Search queries for "Nexon" on GSG's dark web leak site display restricted search results referencing an unreleased victim profile. Because the post remains private, no verifiable evidence has been provided to confirm either the intrusion or the claimed data exfiltration.
​If verified, the incident would mark Nexon Korea's first major security event in 15 years, following a 2011 breach in which personal information belonging to approximately 13.2 million MapleStory users was exposed. Following that incident, Nexon Korea instituted strict data protection policies, expanded cybersecurity capital expenditure, and overhauled its internal security division.
​Cybersecurity analysts caution that newly formed ransomware organizations routinely list major corporate targets and exaggerate exfiltration volumes before presenting evidence to force extortion negotiations or elevate their profile. Security researchers emphasize that threat actors frequently recycle legacy datasets or publish fabricated claims, making third-party verification necessary.
​A spokesperson for Nexon Korea said the company is currently investigating the claim.
A post on BreachForums offering alleged SK Telecom subscriber records. (Photo: BreachForums)
Separately, SK Telecom recently addressed an alleged data theft listing posted on the dark web marketplace BreachForums. On July 22 at approximately 10:00 p.m. KST, an actor using the handle "max987" claimed to offer personal records belonging to roughly 26 million SK Telecom subscribers.
​SK Telecom denied the breach, and the Korea Internet & Security Agency (KISA) determined after an initial assessment that the dataset was fabricated.
​"Similar fraudulent claims surface on underground forums approximately once a month, none of which have proven legitimate," an SK Telecom spokesperson said. "KISA has evaluated the data and confirmed that no operational systems were breached."
​Yeom Heung-yeol, professor emeritus of information security at Soonchunhyang University, noted that threat actors are increasingly leveraging artificial intelligence (AI) tools to automate initial reconnaissance and social engineering.
​"It cannot be assumed that a newly surfaced ransomware group lacks advanced technical capabilities simply because it is new," Yeom said. "Because attacker claims alone do not confirm an intrusion, organizations must conduct forensic verification."
​Yeom added that regulatory compliance rules apply when potential data exposures occur. "Under the Personal Information Protection Act, statutory notification procedures are triggered when a data breach is suspected, requiring organizations to notify affected data subjects as a precautionary measure."
kimcastle@thelec.kr
View other news
Copyright © The Elec Inc. No unauthorized transfer and redistribution
Comments
Name
Password
Enter comments
0
/ 400
Submit
Sort the comments.
Newest
Recommended
Top Comments
Best comment
It is automatically exposed by adding up the number of replies and recommendations.
close
더보기
Delete comments
Deleted comments cannot be recovered.
Do you still want to delete it?
Delete
Modify the comments
You can modify comments only within 1 minute after writing.
Text
Modify
My comment
Most Read
1
Apple Presses for 20% Cut in iPhone 18 OLED Panel Prices on 'Chipflation'
2
ASML Posts Second-Quarter Earnings Beat on Strong AI Demand, Raises Full-Year Outlook
3
US Commerce Department Says Nvidia's H200 Shipments to China Have Begun
4
Low-Res Flexible OLED Adoption Rises Amid "Chipflation"
5
Chinese AI Models Close in on OpenAI as Google Delays Gemini 3.5 Pro
6
POSCO Future M to Mass Produce Hard Carbon Anode Material for Sodium-Ion Batteries From 2028
7
Court Dismisses Webzen's Injunction to Block 'Dragon Sword: Awakening' Release
8
Samsung Plans 50-Tool Hybrid Bonding Production Line in Pyeongtaek
9
Intel Foundry Deploys High-NA EUV Tools in High-Volume Production
10
Samsung Weighs Outsourcing Back-End Design for Google's 2nm TPU I/O Die
Editor’s Picks
SK Hynix to Open Cheongju P&T7 Cleanroom Three Months Ahead of Schedule
LS Cable & System Wins Power Infrastructure Supply for Hyundai Motor's Battery Campus
LG Electronics to Shut Down Its First China Manufacturing Plant After 34 Years
More Stories
Everspin Supplies Security Solutions to BRI Danareksa Sekuritas
Gravity Secures China License for New MMORPG ‘Ragnarok Origin: Guardians of Eternal Love 2’
Crimson Desert Steam Revenue Surpasses $190 Million in 2026
congatec Launches AMD Ryzen AI-Based COM-HPC Module
Supermicro Unveils H15 Server Portfolio Powered by AMD's 6th Gen EPYC Processors