South Korea's Samyang Group Units Fined approximately $410000 Over Data Breach ...

Four affiliates of South Korea's Samyang Group have been fined a combined 552 million won (approximately $410,000) in administrative fines and 16.2 million won (approximately $12,000) in penalty surcharges by South Korea's Personal Information Protection Commission for leaking the personal data of nearly 150,000 people. The commission said on Nov. 12 that it held a full meeting on Nov. 11, voted to sanction Samyang Holdings (000070), Samyang Corporation (145990), Samyang Packaging (272550), and Samyang Data System, and decided to publish the disciplinary action.

The incident traces back to July 2022. An unidentified hacker exploited a vulnerability in the Samyang Group mail server to gain administrator privileges, then extracted credentials for an internal file server installed for data migration. 850,000 files (1.3TB) containing the information of 149,767 employees, shareholders, and related parties of Samyang Holdings, Samyang Corporation, and Samyang Packaging were exfiltrated from that server. Of those, resident registration numbers were exposed for 82,750 people.

Poor server management is cited as the reason the damage grew. Samyang Data System, which handles the group's system integration (SI), left the server connected to the external network until the breach occurred, even after the data migration work for the three companies was finished. As a result, the hacker was able to move large volumes of personal data to an external cloud in a short period.

The commission's investigation confirmed multiple violations of the law. First, the three companies that held the personal data did not encrypt resident registration numbers. Samyang Holdings and Samyang Packaging were found to have failed to destroy payroll information for day laborers whose statutory retention period had expired. Samyang Holdings was also caught collecting resident registration numbers during the hiring process without a legal basis. The three companies outsourced work to Samyang Data System but only drew up outsourcing contracts in December 2024, two years and five months after the incident.

The sanctions were imposed separately by violation.

Note: Combined administrative fines for the three companies total 552 million won (approximately $410,000); combined penalty surcharges total 16.2 million won (approximately $12,000).

The action exposes weaknesses in a structure where information protection responsibilities were scattered across affiliates within the group. Critics say that while the three companies that actually held the personal data and the contractor that operated the systems each bore different obligations, no integrated management system to prevent the incident was working. The fact that even the outsourcing contracts were only prepared after the incident shows that the post-incident response system was also not in order.

Industry observers see the decision as a warning sign for group affiliates across the board that handle large volumes of personal data. Because encrypting resident registration numbers, destroying data past its retention period, and documenting outsourced work are relatively basic obligations, similar management gaps could surface at other companies. The commission issued corrective orders alongside the sanctions and decided to publish the violations, making reform of these companies' information protection systems a likely focus of future oversight.