The South Korean government has initiated an official investigation into a hacking incident involving GS Construction's apartment community facility reservation and management system. The company reportedly declined to cooperate with the government investigation, citing its own analysis as the reason, although GS Construction clarified that it only disagreed with the technical support aspect of the investigation.
On November 11, the Ministry of Science and ICT announced its decision to investigate the breach of resident information at GS Construction, following the implementation of the revised Information and Communications Network Act last month. This marks the first instance of an official investigation being launched under the newly established legal committee for reviewing breach incidents.
The incident occurred on the night of October 28. GS Construction detected unusual access attempts at 11:29 PM and subsequently blocked external access. Analysis of access logs revealed that the initial unauthorized access occurred around 10:15 PM on the same day. The affected system is the community facility reservation management system (formerly FMCS).
Information that may have been compromised includes residents' names or nicknames, birth dates, mobile phone numbers, gender, email addresses, home addresses, membership numbers, residency types, passwords, administrator IDs, household head status, membership registration timestamps, last login IP addresses, and RF card numbers. GS Construction stated that the actual data leaked varies by customer and is currently investigating the extent of the breach for each individual.
GS Construction reported the breach on October 29 but did not agree to the investigations by the Ministry of Science and ICT and the Korea Internet & Security Agency (KISA), citing its intention to conduct its own analysis. The committee determined that an official investigation was necessary due to the scale of the leak and the sensitivity of the information involved, and it is considering forming a joint public-private investigation team if the incident is deemed significant.
Previously, government investigations into breach incidents required voluntary reporting or consent from companies. However, under the revised Information and Communications Network Act, which took effect on October 1, official investigations can now be conducted if there is clear evidence of a breach or if there are concerns about potential harm to the public.
A GS Construction representative stated, "We did not refuse the government's and KISA's investigation; rather, we disagreed with the technical support for our own cause analysis and preventive measures. We will cooperate sincerely with the relevant investigations."
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.