Nexon Corp. Listed by Global Secret Group Ransomware Group

On July 26, 2026, Korean gaming giant Nexon Corp. was formally listed on the leak site of the Global Secret Group ransomware operation. The listing states that internal files were exfiltrated during a ransomware attack on the company’s distributed network. The disclosure does not quantify how many individuals are affected, nor does it list the specific types of data contained in the stolen files.

Reported Details from the Leak Site

The Global Secret Group leak page, first observed on July 26, 2026, claims successful exfiltration of internal files following a ransomware deployment. It describes an “internal infrastructure audit” that allegedly uncovered multiple critical entry points across Nexon’s distributed network segments. The listing does not detail the volume or exact nature of the stolen data, nor does it publish any sample files at the time of the initial disclosure. The group has not publicly stated a ransom demand or a specific deadline in the currently visible posting.

Why This Matters for You and Your Family

When a major game publisher like Nexon suffers a breach, the people most directly exposed are its customers, players, and employees. Even without an exact count of affected records, any exfiltrated internal files could contain personal information tied to accounts, payment details, support tickets, or employee records. For gamers and their families this creates immediate risk because stolen credentials or personal details from one service are routinely reused across Steam, Discord, Roblox, banking apps, and email. A single leak can therefore cascade into account takeovers that affect both adults and children who share the same household internet connection or email addresses.

The Doxxing and Identity-Chain Risk

Ransomware groups rarely stop at encrypting systems. Once data is exfiltrated they use it for double-extortion: threatening to publish sensitive files unless paid. Even partial leaks of internal documents can reveal email addresses, usernames, phone numbers, or support conversations that link gaming handles to real-world identities. These fragments become the starting point for doxxing chains that expose home addresses, family member names, and children’s gaming accounts. Public reporting on similar incidents shows that credential leaks from gaming companies frequently surface on multiple underground platforms within weeks, accelerating identity theft, SIM-swapping attempts, and targeted harassment.

Global Secret Group’s Known Track Record

Public reporting attributes the emergence of Global Secret Group to late 2024. The group has targeted organizations across technology, manufacturing, and entertainment sectors. Its typical playbook involves initial access through compromised remote desktop credentials or unpatched internet-facing services, followed by lateral movement across distributed networks, data exfiltration, and deployment of ransomware. The actor then lists victims on its dedicated leak site and applies pressure through both data publication threats and direct extortion. While the full scope of its prior operations remains under investigation, security researchers note the group’s focus on mid-to-large enterprises with complex network architectures, exactly the profile described in the Nexon listing.

What to do

• Run a DoxxScan to map every link between your gaming handles, emails, phone numbers, and real identity, with no-subscription cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 15.4B+ breach records and 100+ platforms so the next exposure is caught in hours rather than months.
• Immediately rotate any password you used for your Nexon account anywhere it has been reused, and switch to 2FA using an authenticator app instead of SMS.
• Cover the entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that can chain back to the same address or parent email.
• Let DoxxScan remediation specialists manage takedown requests for any exposed personal information appearing on data-broker or extortion sites.

The Nexon listing is a reminder that even well-known gaming companies remain high-value targets whose internal compromises can quickly become personal compromises for millions of players. Staying ahead requires more than changing one password. DoxxScan by GalaxyWarden delivers continuous monitoring across 15.4 billion breach records and over 100 platforms, AI-powered identity-chain mapping that connects handles to real identities, hands-on remediation by specialists, and full household coverage that explicitly includes children’s gaming accounts. Acting now limits how far this breach can follow you or your family.