# Nexon Corp breached by Global Secret Group

Published: 2026-07-26 · Severity: elevated · Sectors: technology
Canonical: https://vorant.io/reports/0d945ca1-27f9-5bd9-9530-e6ed763fd5a5/nexon-corp-breached-by-global-secret-group

> Nexon Corp data breach attributed to Global Secret Group with 126,181 compromised users and 297 employees exposed.

Nexon Corp has been targeted in a data breach attributed to the threat actor Global Secret Group. The breach resulted in exposure of 126,181 user accounts and 297 employee credentials, along with 22 third-party employee credentials. The attacker also identified 135 external attack surface weaknesses in the organization's infrastructure. The incident was disclosed through ransomware.live, a platform that indexes publicly visible information posted by ransomware operators. This represents a significant compromise of both internal staff and customer-facing systems at the gaming and entertainment company.

The breach demonstrates the multi-faceted exposure typical of modern ransomware and extortion campaigns, where threat actors combine credential harvesting with reconnaissance of external attack surface before deploying ransomware or conducting other post-exploitation activities. Organizations should treat this as indicative of comprehensive network compromise and assume potential for lateral movement, data exfiltration, and service disruption.

## Mentioned in this report

- Threat actors: Global Secret Group

1 detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.ransomware.live/id/TmV4b24gQ29ycC5AR2xvYmFsIFNlY3JldCBHcm91cA==

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/0d945ca1-27f9-5bd9-9530-e6ed763fd5a5/nexon-corp-breached-by-global-secret-group.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup