LG Uplus(032640) experienced a breach in Feb. 2023 in which customer personal information was leaked, exposing the data of about 297,000 people to the outside. The company said that after the crisis it would expand its information security investment to 100 billion won, more than triple the level before the incident. And at the end of 2024 and 2025, it promised to "expand information security investment by more than 30% year over year, respectively." In the first year, 2024, the information security investment amount increased 31% from a year earlier, keeping the promise. However, in 2025 the information security growth rate was only 16.7% year over year. The information security investment growth rate was cut in half in a year, and the promise was not kept.
On the 31st, according to the information security disclosure integrated portal of the Korea Internet & Security Agency (KISA), LG Uplus' information security investment rose to 82.8 billion won in 2024 from 63.2 billion won in 2023. That is an increase of 19.6 billion won (31%) in a year. The 2025 information security investment was 96,627.88 million won, up about 13.8 billion won from 2024. Although the investment amount itself increased, the year-over-year growth rate is half the 2024 level (16.7%).
For LG Uplus to expand the information security investment amount by more than 30% year over year in 2025 as promised, it should have invested at least 107.64 billion won. However, the information security investment actually disclosed to KISA was about 11 billion won less than that. While the company did not cut investment, based solely on the disclosure figures verifiable externally, it fell short of the annual expansion goal it set for itself.
Of course, LG Uplus has been increasing expenditure on information security since the personal information leak. LG Uplus' information security investment rose steadily from 29.2 billion won in 2021 to 44.2 billion won in 2022, 63.2 billion won in 2023, and 82.8 billion won in 2024. However, the pace of increase in information security investment has been easing each year. The company's year-over-year information security investment growth rate was 51.4% in 2022, 43% in 2023, and 31% in 2024. Still, it consistently stayed above 30%. But last year the year-over-year information security investment growth rate fell to 16.7%. This came even as it has not yet achieved the 100 billion won level of information security investment.
LG Uplus explained, "Because the KISA disclosure amount reflects security facility investment on a depreciated basis, the growth rate appears lower than the actual execution amount." The company cited depreciation as the reason why the promise was not kept, pointing to the gap between the disclosed amount and the actual execution amount. It said that security facility investment such as servers and network equipment is not fully recognized at the time of acquisition but is allocated over the period of facility use. As a result, the amount spent in a given year and the disclosed amount may differ.
Depreciation is not an accounting treatment newly applied last year. The same method applied to prior disclosures. Given that the investment growth has slowed significantly under the same standard, it is hard to judge that the plan was fulfilled based on depreciation alone. Of course, as the company noted, it is possible the actual execution amount rose by more than 30%. However, to verify the company's explanation, it must be possible to confirm the difference between the pre-depreciation actual execution amount and the disclosed amount. That means it should present how much of the new investment was reflected in the disclosure and roughly how much was excluded due to accounting treatment. But LG Uplus did not release the relevant data.
It is certainly a positive that LG Uplus has steadily increased information security investment since the personal information breach. But for a listed company, the numerical targets it presents to the market are not declarations; they are promises. If the disclosed figures and the actual execution amount differ, it must explain the gap and the reasons with objective data. Otherwise, the market has no choice but to judge based on the disclosure that it "failed to meet the promised target," rather than the claim that it "increased investment." Trust is built not by the size of the investment but by keeping promises and proving it transparently.