The disclosed material the group revealed on Wednesday included mobile phone numbers, internal extensions, job titles and profile photographs, all of which matched current and former staff records, the company said.
The Telegram channel, opened in 2023 and followed by about 2,800 users, surfaced over the weekend and prompted an internal probe pointing to a likely insider leak rather than an external hack, given that some of the exposed fields could only be retrieved through CJ's intranet.
"We will cooperate fully with the police investigation," a CJ Group spokesperson said, adding that affected employees had been notified individually and that the company was taking steps to prevent secondary harm.
The breach does not meet the threshold for mandatory reporting to the Personal Information Protection Commission, the company said, as it involves fewer than 1,000 people and does not include resident registration numbers or other sensitive identifiers.
Even so, the incident has drawn fresh scrutiny because the leaked photographs and contact details target female staff exclusively, raising the prospect of stalking, harassment and other downstream abuse.
The CJ leak lands amid a punishing run of cyber and data incidents at South Korean conglomerates.
Shinsegae Group's IT affiliate disclosed in late December that malware had compromised the records of about 80,000 employees, including staff numbers and, for some, names, departments and IP addresses, through the group's intranet.
Days later, Korean Air said about 30,000 employee records, including names and bank account numbers, were exposed when Korean Air C&D Services, a catering supplier spun off from the airline in 2020, was breached by an external hacker group.
Mobile carriers SK Telecom and KT also came under government investigation last year, with the SK Telecom breach exposing internal data tied to roughly 27 million users.
Copyright ⓒ Aju Press All rights reserved.
