It was revealed that subsidiaries of Samyang Group had left an internal server, which was no longer in use, connected to the external network, resulting in the leakage of personal information belonging to approximately 150,000 people.
The Personal Information Protection Commission announced on the 12th that it held a plenary meeting on the 11th and imposed a total fine of 552 million won and an administrative penalty of 16.2 million won on Samyang Group subsidiaries, including Samyang Holdings, Samyang Co., and Samyang Packaging, for violating the Personal Information Protection Act.
A hacker exploited a vulnerability in Samyang Group's mail server in July 2022 to gain administrator privileges, after which they stole authentication information for an internal file server.
Subsequently, approximately 850,000 files totaling 1.3 TB, containing the personal information of 149,767 employees, shareholders, and related parties stored on that server, leaked to an external cloud. The leaked information also included the resident registration numbers of 82,750 people.
The file server in question had been installed for data migration purposes. However, even after the data migration was completed, it remained in a state where it could communicate with the external network until the time of the incident.
According to the Personal Information Protection Commission's investigation, Samyang Data System did not decommission the server or block external access. As a result, it was found that the hacker was able to extract a large amount of personal information externally in a short period.
Samyang Holdings, Samyang Co., and Samyang Packaging also failed to properly implement safety measures such as encrypting resident registration numbers. Samyang Holdings and Samyang Packaging did not dispose of salary information for daily workers whose retention periods had expired. It was also confirmed that Samyang Holdings collected resident registration numbers without legal basis during the recruitment process.
It was also revealed that they drafted outsourcing contracts late after entrusting personal information processing tasks. The three Samyang companies had already entrusted personal information processing to Samyang Data System as of July 2022, when the incident occurred, but the relevant contract was only prepared in December 2024.
The Personal Information Protection Commission imposed a fine of 184 million won and an administrative penalty of 184 million won on each of the three Samyang companies. Separate administrative penalties were imposed on subsidiaries that violated obligations such as disposing of personal information, and a corrective order was issued to Samyang Data System.
The Personal Information Protection Commission stated, "Even if basic safety measures are faithfully implemented, such as decommissioning servers that have been discontinued or blocking external access, and promptly disposing of unnecessary personal information, the possibility and damage of personal information leakage can be reduced."
in TECH
