[Edaily Reporter An Yu-ri ] The Personal Information Protection Commission announced on the 30th that it has decided to refer LG Uplus(032640)(LG Corp.) to law enforcement agencies for investigation after the company disposed of its servers prior to the Commission’s investigation, thereby destroying evidence of hacking and personal information leaks.

The Commission made this announcement after revealing that it had voted the previous day to impose a fine of 53.979 billion won on KTCorporation and to file a criminal complaint against KTCorporation for obstructing the investigation by submitting false documents and other acts during the probe.

In the case of LGU+, unlike KTCorporation, evidence had been concealed or destroyed—such as by scrapping servers—before the Commission began its investigation; therefore, the actions did not meet the criteria for “obstruction of an investigation” under the Personal Information Protection Act. Consequently, the Commission decided to refer the case to law enforcement agencies for investigation under the Criminal Act for “obstruction of official duties.”

Previously, the Personal Information Protection Commission became aware of the LG Corp. personal information leak reported by the U.S. security magazine “Phrack” in August 2025 and launched an investigation on September 10 of the same year to review the facts surrounding the leak.

During the investigation, the Commission examined whether text files containing the names and account information of LGU+ employees and partner company staff had been leaked; it was confirmed that this information was actually held and managed by LGU+ within its integrated password management system (Automated Process Policy Management, “APPM”).

However, prior to the start of the investigation—on August 12 and August 14, 2024—LGU+ reinstalled the operating systems (OS) on relevant servers, including the APPM server, and decommissioned them on August 25, 2025, thereby preventing the Commission from verifying the exact circumstances of the leak or determining whether any additional data had been leaked through its investigation.

In response, the Personal Information Protection Commission stated that it recognizes these regulatory loopholes and the limitations of administrative investigations and will push for institutional reforms to ensure the effectiveness of investigations.

Under current regulations, while criminal penalties and administrative fines can be imposed for acts such as concealment “during an investigation,” sanctions for acts occurring “before an investigation begins” are insufficient, creating a regulatory loophole where it may actually be advantageous for businesses to conceal or destroy evidence in advance when an incident occurs.

To ensure that personal information breaches are reported in a timely manner to minimize secondary damage, the Commission will pursue institutional improvements, including: △ establishing criminal penalties for acts of concealment or destruction “prior to the commencement of an investigation”; △ imposing administrative fines (3% of total revenue) for the concealment or destruction of evidence; and △ providing rewards to whistleblowers who report such acts and thereby contribute to the investigation and enforcement.

Furthermore, to prevent investigations from being delayed due to a business operator’s lack of cooperation, the government plans to amend the Personal Information Protection Act to: △ impose enforcement fines (0.3% of daily revenue) for failure to cooperate with investigations or comply with corrective orders; and △ enable the issuance of data preservation orders in the event of a data breach.

Song Kyung-hee, Chair of the Personal Information Protection Commission, emphasized, “This penalty should serve as an opportunity to further strengthen the security capabilities of the entire telecommunications industry, which provides services essential to the public’s daily lives.” She added, “In particular, we will improve the system so that concealing or downplaying data in the event of an incident results in significant disadvantages for companies, thereby instilling a widespread industry-wide recognition that transparent disclosure is the most rational choice going forward.”

LG Uplus stated, “A police investigation into the same matter is already underway, and we are cooperating fully with the police,” adding, “We will continue to cooperate fully with the police investigation.”