The Personal Information Protection Commission has imposed a total fine of 5.52 billion won and an additional penalty of 16.2 million won on four subsidiaries of Samyang Group for violating personal information safety obligations. An investigation revealed that approximately 150,000 individuals' personal data was leaked due to a hacking incident, with basic protective measures such as encryption of resident registration numbers and data disposal being insufficient.
On November 11, the commission held a plenary meeting and announced the sanctions against Samyang Holdings, Samyang Corporation, Samyang Packaging, and Samyang Data Systems.
According to the commission's investigation, an unidentified hacker exploited vulnerabilities in Samyang Group's internal mail server in July 2022 to gain administrative access and steal authentication information from an internal file server set up for data transfer. This breach resulted in the external leak of approximately 850,000 files containing personal information of 149,767 individuals, including data for 82,750 people with resident registration numbers.
The investigation identified inadequate safety measures at the subsidiaries as the cause of the incident. Samyang Data Systems left the file server connected to an external network even after data transfer operations for Samyang Holdings and the other three companies were completed. This allowed the hacker to access the server and quickly leak personal information to an external cloud.
Samyang Holdings, Samyang Corporation, and Samyang Packaging also failed to implement necessary measures to ensure the safety of personal information, such as encrypting resident registration numbers. Additionally, Samyang Holdings and Samyang Packaging did not dispose of payroll information for temporary workers after the legal retention period had expired, and it was confirmed that Samyang Holdings collected resident registration numbers without legal justification during the hiring process.
The commission imposed fines of 184 million won and penalties of 1.8 million won on Samyang Holdings, Samyang Corporation, and Samyang Packaging for violating the obligation to encrypt resident registration numbers and the requirement to document the outsourcing of personal information processing. Samyang Holdings and Samyang Packaging were also fined an additional 3.6 million won each for failing to dispose of personal information. Furthermore, Samyang Holdings received a penalty of 3.6 million won for collecting resident registration numbers without legal grounds.
The commission has also issued corrective orders against Samyang Data Systems for violating safety obligations.
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.