The Personal Information Protection Commission said on the 27th it will impose a 73.5 million won penalty surcharge on HD Construction Equipment and 4.8 million won in fines on HD Korea Shipbuilding & Offshore Engineering, both under HD Hyundai Group, for leaking employee personal information due to inadequate security measures.
The Personal Information Protection Commission said at a plenary meeting held the previous day that it approved imposing a penalty surcharge and fines on two HD Hyundai Group affiliates that violated personal information protection laws. The companies were found to have neglected security measures such as access control for personal information processing systems, leading to the leak of personal information.
The investigation found that an unidentified hacker exploited a vulnerability in the mobile device management server operated by HD Korea Shipbuilding & Offshore Engineering in March 2024 to upload a web shell file. The hacker then accessed an internal business system of HD Construction Equipment that could communicate with the server and leaked the personal information of 9,503 people, including the names and employee numbers of HD Construction Equipment executives and staff and partner company employees.
According to the Personal Information Protection Commission, the mobile device management server of HD Korea Shipbuilding & Offshore Engineering lacked security measures against a file upload vulnerability and was used as the leak vector. In addition, while business linkage between the mobile device management server of HD Korea Shipbuilding & Offshore Engineering and the internal business system of HD Construction Equipment was unnecessary, the companies did not restrict cross-system access, allowing the hacker to reach HD Construction Equipment's personal information processing system through HD Korea Shipbuilding & Offshore Engineering's personal information processing system.
Accordingly, the Personal Information Protection Commission imposed a 73.5 million won penalty surcharge on HD Construction Equipment, where executives' and employees' personal information was leaked, and 4.8 million won in fines on HD Korea Shipbuilding & Offshore Engineering, which was used as the leak vector.
An official at the Personal Information Protection Commission said, "This leak occurred because the personal information controller neglected measures related to vulnerabilities in the personal information processing system and failed to implement access controls on servers that did not require business linkage."
The Personal Information Protection Commission recommended that personal information controllers regularly review security measures to prevent personal information from being exposed or leaked through web vulnerabilities and restrict access to personal information processing systems by internet protocol (IP) and other means to block and control unnecessary access in order to prevent illegal access and breaches.