Woowa Brothers, the operator of Baemin, which was shaken by the “retaliatory terror incident,” is strengthening its personal information protection system. The company conducted on-site inspections of the outsourced vendor that had become a channel for data leakage and upgraded its security guidelines.
On the 1st, Woowa Brothers announced that it would implement follow-up measures in this manner regarding the “recommendation for improvement” decision made by the Personal Information Protection Commission concerning the retaliatory terror incident.
First, Woowa Brothers conducted comprehensive on-site inspections of all partner companies entrusted with personal information to verify the status of security solution deployment and management systems. The number of items on the inspection checklist was increased from the previous 31 to 53. The added items include △ whether mock accident drills have been conducted and measures to prevent recurrence have been established, △ verification of the deployment status of security solutions such as Data Loss Prevention (DLP) and Network Access Control (NAC), and △ review of disk disposal history.
The inspection procedures were also strengthened. Woowa Brothers visited the outsourced vendors and directly conducted comprehensive on-site inspections of the entire data lifecycle, from collection to storage, use, provision, and disposal of personal information. Subsequently, potential risk factors by vendor and system were identified and corrective measures were implemented. In addition, the company supplemented the content of the information protection agreement based on the entrustment relationship, strengthened pre-inspection procedures for personal information protection matters according to manuals when opening new customer service centers, and systematized the outsourcing process.
The “Baemin retaliatory terror incident” refers to a case in which a retaliation agency organization had its members pose as counselors and gain employment at an outsourced partner of Baemin’s customer center, where they illegally accessed and leaked customer information such as names and addresses. Using the secured information, the perpetrators committed retaliatory terror acts, including smearing feces and other filth on victims’ front doors and writing abusive language with lacquer.
Retaliatory terror is a new type of crime in which an attacker assaults or harasses a victim out of resentment to instill fear or cause harm. As in this case, organizations that handle retaliatory terror on behalf of clients may commit crimes after receiving requests. Police detected circumstances related to this incident while investigating retaliatory terror agency crimes that occurred in Siheung, Gyeonggi Province, and Yangcheon-gu, Seoul, last January.
At the time of the incident, Woowa Brothers issued a statement saying, “We are taking this incident very seriously,” adding, “We are actively cooperating with the police investigation and will promptly implement follow-up measures.” The company stated that it had conducted a comprehensive audit related to personal information protection on the relevant outsourced vendor and proceeded with contract termination procedures. It also announced its policy to strengthen internal controls, including tightening recruitment standards for customer service personnel and inspecting management practices.
Woowa Brothers proactively reported cases where misuse of information was confirmed to the Personal Information Protection Commission. After a formal investigation, the Personal Information Protection Commission resolved on the “recommendation for improvement” at its plenary meeting on the 9th and delivered the content of the decision that day. A Woowa Brothers official stated, “We will continue to strengthen measures to protect users’ valuable personal information.”
Meanwhile, the Prosecution Service requested prison sentences for three people, including mastermind Jeong Mo, who handled “retaliatory terror” on behalf of clients. The prosecution asked the court to sentence Mr. Jeong to five years in prison and Yeo Mo, a woman who posed as a counselor at Baemin’s outsourced vendor, to three years in prison. For intermediary Lee Mo, it requested six months in prison for crimes committed before November 6 last year, and four years and six months in prison for subsequent offenses.
in TECH
