Qilin ransomware gang steals data of Korean funds after breaching IT subcontractor
Learn More
A cyberattack claimed by the ransomware group Qilin has compromised data from approximately 20 asset management firms in South Korea through a breach of an IT subcontractor's cloud server.
Qilin has dubbed the attack the "Korean Leak" campaign. The incident occurred in early September 2025, when a cloud server maintained by an IT subcontractor and used mostly by local small and medium-sized private equity funds hacked.
The attack was publicly claimed by Qilin on September 14, 2025, when the ransomware group began posting victim profiles on their dark web leak site, accompanied by samples of exfiltrated data. The breached IT subcontractor is not named.
Exposed data includes:
- Tax-related documents
- Employee data and personal information
- Personal information of investors and clients
- Financial reports and customer lists
- Investment strategies and forecasts
- Corporate budgets and contracts
- Account statuses and portfolio information
- Internal communications and strategic documents
Impacted companies include:
- VANCHOR Asset Management reportedly suffered the loss of 27 gigabytes of data, including thousands of investor records, account statuses, and long-term strategy documents
- APEX Asset Management
- Majesty Asset Management Co.
- Melon Asset Management Co.
- LX Asset Management
- Human and Bridge Asset Management
- Awesome Asset Management Co.
- Klarman Asset Management
- Pollex Asset Management Co.
Hackers claim to have seized evidence of stock market manipulation at LX Asset Management, as well as collusion between Human and Bridge Asset Management and Majesty Asset Management.
The number of affected individuals has not been disclosed by authorities or the affected companies.
South Korea's Financial Supervisory Service (FSS) stated that, as of Monday, no confirmed cases of monetary damage or stolen credit information have been reported. Regulators have begun a coordinated investigation with the National Police Agency's Cyber Bureau and are working with international partners, including Interpol.
