Now Hacked
EN-GB
Data breach

Hack at four Samyang Group companies exposes 149,767 people's personal information

First reported · Last reported · 23 related reports

In July 2022, approximately 850,000 files totalling 1.3 TB and containing the personal information of 149,767 employees, shareholders and other associated individuals were leaked from four Samyang Group companies. The attacker exploited a mail server vulnerability to gain administrator privileges, stole file server credentials and exfiltrated data, which included the resident registration numbers of 82,750 people. The Personal Information Protection Commission (PIPC) found that a server no longer in use had been left connected to an external network and that resident registration numbers had been inadequately encrypted, among other shortcomings, and approved sanctions including an administrative fine of KRW 552 million; Samyang Group said it had strengthened its security systems after the incident.

Key facts

Affected organisation
Samyang Group
Incident type
Data breach
Occurred / detected
2022-07
Scale of damage
Approximately 850,000 files totalling 1.3 TB containing 149,767 people's personal information were leaked, including the resident registration numbers of 82,750 people
Cause / method
The attacker exploited a mail server vulnerability to obtain administrator privileges and file server credentials, then exfiltrated data from a migration server connected to an external network
Location
South Korea

If your data was exposed

Exposed dataNational ID number

  1. Block new mobile phone activations in your name, and register with the Financial Supervisory Service as a person whose personal data was exposed to strengthen identity checks on financial transactions in your name. If a copy of your ID was leaked, consider having it reissued.Identity theft prevention service (M-Safer) ↗Personal data exposure accident prevention system ↗
  2. If you’ve suffered harm, report it. Call 118 (no area code) for privacy violations, contact the police for financial losses, and apply for dispute mediation to seek compensation.Personal Information Infringement Report Centre ↗Korean National Police Agency cybercrime report ↗Personal Information Dispute Mediation Committee ↗

Timeline

  1. The Personal Information Protection Commission (PIPC) approved sanctions at a plenary meeting against Samyang Group affiliates for inadequate security measures related to the personal information leak that occurred in July 2022.
  2. Details were disclosed of how 149,767 people's personal information was leaked, investigation findings concerning the server left connected and inadequate encryption of resident registration numbers, and sanctions including an administrative fine of KRW 552 million.
  3. Samyang Group said it had substantially strengthened its security systems following the personal information leak.

23 related reports

The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.