Halys, where a personal information leakage incident occurred, recommended changing passwords for services that use the same account information, including membership accounts. Halys also urged customers not to respond to or click links in calls, text messages, or emails of unknown origin to prevent secondary damage.
In an official statement on the 19th, Halys said, "We confirmed that unauthorized access occurred on the 16th to a cloud service using our membership information, resulting in the leakage of personal data." The company explained, "We assess that the cloud service was hacked for cryptocurrency mining purposes, and some customer information was leaked in the process."
It added, "The leaked data is assessed to be temporary data files provided for a past membership service overhaul, rather than the currently active customer database." The company further stated, "The scale of the personal information leakage reported through KISA is approximately 2.76 million records, estimated to be cumulative customer data from 2009 up to February 11, 2020, including duplicate members."
To date, Halys has identified the leakage period as September 3 to October 7. The confirmed leaked items include user IDs, passwords, names, dates of birth, phone numbers, addresses, email addresses, Duplicate Registration Confirmation Information (DRCI), and service usage-related information. Halys immediately implemented emergency response measures, such as blocking unauthorized access paths to the relevant service, and is conducting an internal investigation into the detailed circumstances.
Halys plans to continuously monitor the possibility of secondary damage caused by the leaked personal information and to comprehensively review access permissions, authentication systems, and security systems for personal data based on the cause and vulnerabilities of this incident. The company also intends to promptly discontinue the membership service using the relevant cloud.
A Halys official said, "We deeply apologize for the concern caused to our customers and will do our best to protect customer information and minimize damage."
in TECH
