Samyang Group affiliates fined over breach of 150,000 people’s data - Korea JoongAng Daily
Four Samyang Group affiliates have been fined for exposing personal information of about 150,000 people after investigators found they had skipped basic safeguards such as encrypting resident registration numbers.
The Personal Information Protection Commission (PIPC) imposed penalty surcharges totaling 552 million won ($413,000) and administrative fines of 16.2 million won on the companies at a plenary meeting on Wednesday, the commission said Thursday.
The four companies fined are Samyang Holdings, Samyang Corporation, Samyang Packaging and Samyang Data Systems. Samyang Group, founded in 1924, runs chemicals, food ingredients, packaging and biopharmaceutical businesses. It is separate from Samyang Foods, the maker of Buldak ramyeon, and from camera lens maker LK Samyang, formerly Samyang Optics.
Security Failures
An unidentified hacker exploited a vulnerability in Samyang Group's mail server in July 2022 to gain administrator privileges. The hacker then stole the login credentials for an internal file server set up to transfer data and took about 850,000 files totaling 1.3 terabytes.
The files contained the personal information of 149,767 people, including employees, shareholders and others linked to the three main affiliates. The leaked data included the resident registration numbers of 82,750 people.
The breach stemmed from a failure to take basic safety measures, such as decommissioning servers no longer in use or blocking outside access to them.
Data Handling Violations
Samyang Data Systems, which handles system management for the group, left the file server connected to the outside network even after the data transfer was complete, allowing the hacker to move personal information to an outside cloud service.
The PIPC found that Samyang Holdings, Samyang Corporation and Samyang Packaging had not encrypted resident registration numbers and had kept salary information on day laborers past the legal retention period. Samyang Holdings also collected job applicants' resident registration numbers during hiring without any legal basis.
The three companies had entrusted data processing to Samyang Data Systems when the breach occurred in July 2022, yet did not draw up an outsourcing contract until December 2024, more than two years later.
Penalties Imposed
The PIPC imposed penalty surcharges of 184 million won each on Samyang Holdings, Samyang Corporation and Samyang Packaging. Administrative fines came to 9 million won for Samyang Holdings, 1.8 million won for Samyang Corporation and 5.4 million won for Samyang Packaging.
Samyang Data Systems, which breached its duty to take safety measures such as access controls, received a corrective order and must publicly disclose the sanction.
Related
