[Edaily Reporter An Yu-ri ] Two affiliates of HD HYUNDAI Group were slapped with fines and penalties totaling approximately 70 million won following a personal information leak involving employees that occurred in March 2024.

The Personal Information Protection Commission announced on the 27th that, following its 17th plenary session held on the 26th, it imposed a fine of 73.5 million won on HD Hyundai Construction Equipment(267270)for violating the Personal Information Protection Act, and a penalty of 4.8 million won on HD KOREA SHIPBUILDING & OFFSHORE ENGINEERING(009540), which served as the route for the data breach.

The incident occurred in March 2024. An unidentified hacker exploited a vulnerability in a mobile device management server operated by HD KOREA SHIPBUILDING & OFFSHORE ENGINEERING to upload a WebShell file. A WebShell is malicious software that allows hackers to remotely control a server.

Through this, the hacker gained access to HD Construction Equipment’s internal business systems, which were capable of communicating with the server. In the process, the personal information of 9,503 individuals—including the names and employee ID numbers of HD Construction Equipment executives, employees, and partner company staff—was leaked.

An investigation by the Personal Information Protection Commission revealed that HD KOREA SHIPBUILDING & OFFSHORE ENGINEERING’s mobile device management server lacked adequate security measures against file upload vulnerabilities, which allowed it to be exploited as a pathway for the personal information leak.

It was also confirmed that, despite there being no business necessity for a connection between HD KOREA SHIPBUILDING & OFFSHORE ENGINEERING’s mobile device management server and HD Construction Equipment’s internal business system, access between the two companies’ systems was not restricted. The investigation found that the hacker exploited this system architecture to gain access to HD Construction Equipment’s internal business system.

The Personal Information Protection Commission determined that this incident occurred because the personal information processor neglected to take measures regarding vulnerabilities in the personal information processing system and failed to implement access control measures for servers that did not require business-related integration.

The PIPC urged, “To prevent personal information leaks, security measures must be reviewed regularly, and access permissions to personal information processing systems must be restricted—for example, by IP address—to block and control unnecessary access and prevent security breaches.”