Four Samyang Group affiliates fined 550 million won after leaving a server unattended and exposing the personal data of 150,000 people

[Financial News] Four Samyang Group affiliates have been hit with a 552 million won penalty surcharge after leaving a server that was no longer in use unattended, exposing the personal data of 150,000 people, including their resident registration numbers. 
The Personal Information Protection Commission (PIPC) said it had held a plenary meeting on the 11th and resolved to impose a total of 552 million won in penalty surcharges and 16.2 million won in administrative fines, as well as issue corrective orders and take other measures against four Samyang Group companies that violated personal information protection laws.
The four companies subject to sanctions are holding company Samyang Holdings Corporation, Samyang Corporation, Samyang Packaging and Samyang Data Systems.
According to the PIPC’s investigation, in July 2022 a hacker exploited a vulnerability in a Samyang Group mail server to gain administrator privileges, then stole the authentication credentials for an internal file server installed for data migration.

The hacker then exfiltrated about 850,000 files (1.3 TB) from that server, containing the personal information of 149,767 people in total, including employees, shareholders and other related parties of Samyang Holdings Corporation, Samyang Corporation and Samyang Packaging. The leaked information also included the resident registration numbers of 82,750 people.
The investigation found that Samyang Data Systems, which handles system management for Samyang Group, left the file server connected to an external network even after the data migration work had been completed.
As a result, the hacker was able to exfiltrate personal information stored on the server to an external cloud in a short period of time, the investigation found.
The three companies—Samyang Holdings Corporation, Samyang Corporation and Samyang Packaging—also failed to take necessary security measures, such as encrypting resident registration numbers.
Samyang Holdings Corporation and Samyang Packaging failed to destroy payroll information for day laborers even after the legally required retention period had expired. The investigation also found that Samyang Holdings Corporation collected resident registration numbers during recruitment without a legal basis.
It was also found that the companies failed to properly draw up contracts when outsourcing personal information processing tasks.
At the time of the data breach in July 2022, the three Samyang companies had outsourced personal information processing tasks to Samyang Data Systems. However, they did not draw up the relevant contracts until December 2024, more than two years after the incident. In response, the PIPC imposed a penalty surcharge of 184 million won on each of Samyang Holdings Corporation, Samyang Corporation and Samyang Packaging.
The administrative fines were set at 9 million won for Samyang Holdings Corporation, 1.8 million won for Samyang Corporation and 5.4 million won for Samyang Packaging.
The PIPC resolved to issue a corrective order and take public disclosure measures against Samyang Data Systems for violating its security obligations, including access controls.
The PIPC said, “This incident occurred because basic security obligations were neglected, including the failure to dispose of servers that were no longer in use. The damage was compounded by inadequate encryption of resident registration numbers and the long-term retention of unnecessary personal information,” and urged that “servers no longer in use be disposed of or blocked from external access, and unnecessary personal information be destroyed promptly—in other words, that basic security obligations be rigorously fulfilled.”

[email protected] Lee Gu-sun Reporter