SK Communications (Nate / Cyworld) breach

On 26 July 2011, SK Communications — operator of the portal Nate and the social-networking giant Cyworld — suffered what was then the largest data breach in South Korean history, exposing the personal information of roughly 35 million users, the majority of the country's online population.

What happened

Rather than directly storming SK Communications' servers, the attackers used a supply-chain technique. They compromised the update mechanism of ALZip, a widely-used Korean file-compression utility, and pushed malware to machines inside SK Communications during a routine software check. That foothold let them reach the company's internal databases and exfiltrate user records over the network.

The Korea Communications Commission (KCC) traced the malicious traffic to IP addresses in China, and Chinese-based attackers were widely blamed, though no individuals were ever publicly identified or prosecuted abroad.

What was stolen

The breach exposed users' names, resident-registration (national ID) numbers, phone numbers, email addresses, user IDs and passwords. SK Communications stated that passwords and resident-registration numbers had been protected with encryption, but the sheer breadth of exposure — combined with Korea's reliance on resident-registration numbers as universal identifiers — made the leak extremely serious for identity fraud.

Impact and aftermath

• About 35 million Nate and Cyworld accounts were affected — at the time placing this among the ten largest breaches ever recorded worldwide.
• The incident intensified scrutiny of how Korean platforms collected and stored resident-registration numbers, accelerating a national shift away from using them for online sign-ups.
• In February 2013, a Seoul court ordered SK Communications to compensate identity-theft victims (reported at around 200,000 won each), ruling that the company had "completely failed to notice the phased theft" and had relied on insecure third-party software.

Why it matters

The Nate/Cyworld breach is a landmark supply-chain attack — years before "supply chain" became a mainstream security term — showing how a trusted software-update channel could be weaponised to reach an entire platform. It is also a defining moment in South Korea's privacy history: the scale of the exposure of resident-registration numbers helped push the country to legally restrict their collection by online services, reshaping how Korean websites authenticate users to this day.