Two HD Hyundai Group affiliates have been penalized for failing to take adequate security measures, allowing employee personal data to be leaked.
The Personal Information Protection Commission said on the 27th that it held a plenary meeting on the 26th and decided to impose a fine of 73.5 million won on HD Construction Equipment and an administrative penalty of 4.8 million won on HD Korea Shipbuilding & Offshore Engineering for violating personal data protection rules.
According to the commission's investigation, a hacker breached a mobile device management server operated by HD Korea Shipbuilding & Offshore Engineering in March 2024 by exploiting a vulnerability in the system. The hacker then accessed an internal business system at HD Construction Equipment, which was able to communicate with that server, and stole personal data including the names and employee numbers of 9,503 HD Construction Equipment employees and contractor staff.
The commission found that the mobile device management server at HD Korea Shipbuilding & Offshore Engineering had inadequate safeguards against a file upload vulnerability, which was exploited as the entry point for the hack. It also found that the two companies had not restricted access between their networks even though the systems did not need to be linked for business purposes, opening a path for the intrusion.
"Personal data handlers must regularly review security measures to prevent the leak or exposure of personal data through web vulnerabilities," a commission official said. "To block illegal access and security incidents, it is necessary to thoroughly cut off and control unnecessary system access through measures such as IP restrictions."
