Samyang Group affiliates fined over breach of 150000 people's data

Investigators found the firms kept unnecessary data, failed to encrypt resident registration numbers and delayed formal outsourcing contracts for more than two years.

Four Samyang Group affiliates have been fined for a data breach that exposed the personal information of 150,000 people, after investigators found they had skipped basic safeguards such as encrypting resident registration numbers.

The Personal Information Protection Commission (PIPC) imposed penalty surcharges totaling 552 million won ($413,000) and administrative fines of 16.2 million won on the companies at a plenary meeting on Wednesday, the commission said Thursday.

The four are Samyang Holdings, Samyang Corporation, Samyang Packaging and Samyang Data Systems. Samyang Group, founded in 1924, runs chemicals, food ingredients, packaging and biopharmaceutical businesses. It is separate from Samyang Foods, the maker of Buldak ramyeon, and from camera lens maker LK Samyang, formerly Samyang Optics.

Yonsei University cyberattack exposes personal data of 10,000 students, graduates

Yonsei University cyberattack exposes personal data of 10,000 students, graduates

Court suspends Coupang’s 201.1 billion won privacy fine

Court suspends Coupang’s 201.1 billion won privacy fine

Court keeps Coupang’s record data breach fine in force

Court keeps Coupang’s record data breach fine in force

The PIPC imposed penalty surcharges of 184 million won each on Samyang Holdings, Samyang Corporation and Samyang Packaging. Administrative fines came to 9 million won for Samyang Holdings, 1.8 million won for Samyang Corporation and 5.4 million won for Samyang Packaging.

Samyang Data Systems, which breached its duty to take safety measures such as access controls, received a corrective order and must publicly disclose the sanction.

An unidentified hacker exploited a vulnerability in Samyang Group’s mail server in July 2022 to gain administrator privileges, the PIPC’s investigation found. The hacker then stole the login credentials for an internal file server set up to transfer data.

From that server, the hacker took 850,000 files totaling 1.3 terabytes. The files held the personal information of 149,767 people, including employees, shareholders and others linked to Samyang Holdings, Samyang Corporation and Samyang Packaging. The leaked data included the resident registration numbers of 82,750 people.

Samyang Data Systems, which handles system management for the group, left the file server connected to the outside network even after the data transfer was complete. The open connection allowed the hacker to move the personal information stored on the server to an outside cloud service in bulk, the PIPC concluded.

The PIPC also found that Samyang Holdings, Samyang Corporation and Samyang Packaging had not taken proper safety measures to protect personal information, such as encrypting resident registration numbers.

Samyang Holdings and Samyang Packaging kept salary information on day laborers past the legal retention period instead of destroying it. Samyang Holdings also collected job applicants’ resident registration numbers during hiring without any legal basis.

Samyang Holdings, Samyang Corporation and Samyang Packaging mishandled the contracts for outsourcing their personal data processing as well. The three had already entrusted the work to Samyang Data Systems when the breach occurred in July 2022, yet did not draw up an outsourcing contract until December 2024, more than two years later.

The breach stemmed from a failure to take basic safety measures, such as decommissioning servers no longer in use or blocking outside access to them, the PIPC said. Weak encryption of resident registration numbers and the long-term storage of unnecessary personal information made the damage worse, the commission added.

BY JEONG JAE-HONG [[email protected]]

This article was originally written in Korean and translated by a bilingual reporter with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.