[Edaily Reporter kim mi-kyung ] The BORN Korea has confirmed the possibility that personal information may have been leaked from the backup server of its enterprise resource planning (ERP) system for employees and has issued a preliminary notice regarding the matter. The information potentially at risk of leakage includes data on business partners, current and former employees, and customer service-related information. However, it has not yet been confirmed whether a personal information leak actually occurred or who may have been affected.

#The BORN Korea, a restaurant franchise company led by CEO Baek Jong-won, posted a notice titled “Notice Regarding the Potential Leak of Personal Information from DOUZONE BIZON and Precautionary Measures” on its official website on the 2nd, outlining these details.

According to The BORN Korea on the 3rd, the incident occurred on a backup server managed and operated by DOUZONE BIZON, which is responsible for maintaining The BORN Korea’s ERP system for executives and employees. On the 26th of last month, The BORN Korea received notification from DOUZONE BIZON that unauthorized external access to the backup service had occurred, raising the possibility that personal information may have been leaked.

The BORN Korea stated that DOUZONE BIZON detected abnormal activity during a service inspection and subsequently confirmed through an internal investigation that some encrypted data stored on the backup server had been leaked externally through a vulnerability in the backup solution.

The BORN Korea announced that the information potentially compromised includes personal information related to business partners, current and former executives and employees, and customer inquiries. Business partner information included email addresses, phone numbers, cell phone numbers, bank names, account numbers, and account holders’ names. Information on current and former employees includes employee ID numbers, names, resident registration numbers, addresses, cell phone numbers, emergency contacts, email addresses, and bank names and account numbers. Customer service information includes names, cell phone numbers, email addresses, inquiry details, and store addresses.

However, the company explained, “All of this information was encrypted, and it has not yet been confirmed whether a data breach actually occurred or which specific items were compromised,” adding, “Depending on the results of future investigations by law enforcement and relevant authorities, the determination of whether a breach occurred and the affected individuals may change.”

Immediately after receiving notification of the incident, The BORN Korea took additional measures to prevent further breaches, such as forcibly shutting down the affected backup server through DOUZONE BIZON and blocking access from overseas IP addresses. The company also reported the incident to the Korea Internet & Security Agency (KISA) and is cooperating with the investigations by relevant authorities while implementing additional security enhancements.

Once it is confirmed whether a personal information leak actually occurred and which individuals were affected, the company plans to issue individual notifications. Furthermore, the company urged the public to be cautious of fraudulent communications that mention personal information to demand money or induce recipients to open files or click on links.

A representative from The BORN Korea stated, “This notice is not a confirmation of a personal information leak, but rather a notification to relevant parties regarding the possibility of a leak,” adding, “This incident is completely unrelated to any personal information leaks from online services operated by The BORN Korea.” The representative continued, “We will do our utmost in our follow-up response, including requesting comprehensive additional security measures from DOUZONE BIZON, to minimize the potential harm to those affected.”