Samyang Affiliates Fined Over Data Leak Affecting 150,000

The Personal Information Protection Commission has fined affiliates of Samyang Group a combined total of 552 million won ($397,440) and 16.2 million won ($11,664) for a data breach affecting around 150,000 individuals. This punitive action came after a lack of compliance with fundamental security obligations, such as encrypting resident registration numbers and controlling server access.

The decision was made following a plenary meeting on November 11, which sanctioned four companies: Samyang Holdings, Samyang Corporation, Samyang Packaging, and Samyang Data Systems.

In July 2022, a hacker took advantage of a vulnerability in a mail server of the Samyang Group, gained administrator privileges, and subsequently stole authentication information from an internal file server. As a result, approximately 850,000 files containing personal data of 149,767 people, including employees and shareholders, were leaked externally.

Among these, the resident registration numbers of 82,750 people were compromised. Notably, Samyang Data Systems, responsible for system management, kept the file server connected to the external network even after data migration work was finished. This oversight allowed the hacker to transfer 1.3TB of data to an external cloud service within a brief period.

Furthermore, it was discovered that Samyang Holdings, Samyang Corporation, and Samyang Packaging had not adhered to essential security measures, including not encrypting the stolen resident registration numbers. Additionally, Samyang Holdings continued to retain wage information for daily workers beyond its expiry period, and Samyang Holdings unlawfully gathered resident registration numbers during the hiring process without a legal basis.

Moreover, despite outsourcing work to Samyang Data Systems during the 2022 incident, the management system for entrusted processing of these three companies was found to be inadequate, as they only prepared the required contract documents in December 2024, two years after the incident. The commission imposed individual fines of 184 million won ($132,480) for Samyang Holdings, Samyang Corporation, and Samyang Packaging.

For Samyang Data Systems, which failed to fulfill its duty to implement security measures, the commission issued a corrective order and demanded public disclosure of the violation. The commission concluded that the incident occurred due to the failure to observe basic security rules, such as not disposing of unused servers or blocking external access.

They also emphasized that the prolonged retention of unnecessary personal information amplified the scale of damage, urging businesses to strictly adhere to security measures.