Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
About 35 million members of South Korean services Nate and Cyworld were affected by a July 2011 data breach at their operator, SK Communications. The company discovered the incident on July 26; South Korea’s broadcasting and telecommunications regulator announced it on July 28. Reported fields included names, IDs, email addresses, phone numbers, and encrypted resident registration numbers and passwords.
What happened in the Nate and Cyworld breach?
On July 28, 2011, the regulator said information associated with about 35 million Nate and Cyworld members had been taken in a hacking incident. That is the contemporaneous rounded figure. A later scholarly account reported an exact count of 34,954,887 members; it is a retrospective figure, not the number used in the regulator’s initial announcement.
SK Communications reportedly discovered the incident on July 26, two days before the public announcement. Yonhap’s contemporaneous report also described the affected information as including names, passwords, mobile numbers, email addresses, and resident registration numbers.
What information was reported exposed?
The regulator’s notice listed names, IDs, email addresses, phone numbers, and encrypted resident registration numbers and passwords. Encryption is a protective measure, but its presence does not establish that exposed information was impossible to misuse. It also does not remove the risk associated with other exposed contact and account details.
#1 Best Overall
Was the attacker identified?
Early reports said the system had been accessed through an IP address originating in China. That is a network-origin clue, not proof of the attacker’s nationality, identity, organization, or state sponsorship. At the time, Yonhap reported that the company could not identify when the information had been stolen or who was responsible, and that police would investigate.
A later scholarly review describes a possible technical pathway: an employee workstation was infected with keylogging malware after use of non-commercial ALZip software, and database-access credentials were then stolen. This is a retrospective scholarly account, distinct from the regulator’s initial notice; it should not be mistaken for conclusive attribution of who carried out the attack.
How did the company and authorities respond?
Authorities directed SK Communications to notify users and provide a way to check whether their information had been exposed. The government briefing advised people to change passwords on other services if they had reused the same ID and password, and to watch for voice phishing and spam connected with the exposed contact details.
Free tools Windows power users keep installed
One-click scans. No signup required.
SK Telecom’s 2011 report says SK Communications sent email notices, displayed pop-ups that allowed users to check exposure, and expanded its hotline. Those response details come from the company’s account.
What should affected users learn from the incident?
The practical lesson is that password reuse can carry a breach beyond the service that was compromised. If the same password was used on multiple sites, exposure of one account’s credentials can put other accounts at risk. The advice issued in 2011 was to change reused passwords and stay alert for suspicious messages or calls tied to exposed contact information.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What happened afterward in the legal context?
The 2012 Korea Internet White Paper says South Korea’s Personal Information Protection Act was enacted on September 30, 2011, and took effect on March 30, 2012. That timeline is later than the Nate and Cyworld incident; it should not be read as the law governing the breach retroactively.
A Supreme Court of Korea case notice published on March 28, 2018, reports that SK Communications was not liable for damages in the referenced Nate/Cyworld information-leak litigation. That result is limited to those cases. It does not establish that no security failures occurred or determine liability for every Korean data breach.
Quick Recap
Sources
- Korea Communications Commission notice and government briefing
- Yonhap’s contemporaneous report
- SK Telecom 2011 sustainability report
- Official government briefing transcript
- 2012 Korea Internet White Paper
- Later scholarly review of the incident
- Supreme Court of Korea case notice, March 28, 2018
- Later academic account reporting the exact affected-member count
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
