Huge Breach in South Korea

In late August, South Korean authorities uncovered a huge leak of personal information belonging to over 70 percent of the population aged between 15 and 65. This amounted to a data breach involving over 27 million people and 220 million records. They identified one of the perpetrators as a hacker from China. Sixteen hackers were arrested for allegedly circulating the records and conducting money laundering schemes which earned them at least US$390,000. The hackers targeted registration pages for online gaming and gambling sites and online ring tone and movie ticket stores.

The main perpetrator, known by the surname of Kim, was arrested along with over a dozen others for stealing and selling over 220 million items of personal information from South Koreans. The records included names, account names and passwords, along with resident registration numbers.

According to the police, Kim gained access to the compromised information from a Chinese hacker he met in an online game in 2011. The information had been stolen through hacking registrations from various websites. A registration on any one of those websites can be used to trace registrations for the same person from other online service providers, according to South Korean police. The information was used to seal in-game currency and other game-related items that could be sold offline for profit.

The US$390,000 sum that Kim made was achieved by hacking into six South Korean games. The stolen information was then sold for prices ranging from US$0.001 to US$20 per item, according to its value to hackers or advertisers. The authorities are currently investigating how the stolen information has been circulating and is taking a closer look at other suspects.

In addition to targeting the games, Kim is also alleged to have sold the personal information to scammers running a mortgage fraud ring. This has led to other crimes that have resulted in the loss of the equivalent of US$200,000.

Not the first time

Unfortunately, this isn’t the first time that South Koreans have faced such a huge breach of personal information. Back in 2011, 35 million people – practically the entire country – had their personal information exposed after attackers compromised Cyworld, a South Korean social network, along with the search engine Nate.

According to the country’s data regulator, the Korea Communications Commission, SK Telecom – the company responsible for both the search engine and the social network – had traced the attack to IP addresses in China. It involved the theft of phone numbers, email addresses and even encrypted data like passwords and resident registration numbers of users of their services.

Authorities assumed that the most sensitive data had been taken in its encrypted form, thus the scope of the attack was likely to be low. Users were asked to reset their credentials. Since access to the services is free, no financial data was compromised. However, as we’ve learned from previous data breaches, the major concern would be that the data theft would fuel a rise in spamming, phishing and other social engineering attacks.

And earlier this year, 20 million South Koreans were impacted by a data breach caused by an employee of the Korea Credit Bureau, who was exposed for copying clients’ PII onto an external drive over a period of 18 months.

South Korea and its companies has long been a regular target for attacks, with China and North Korea being the usual suspects. However, these attacks seem to be getting larger in size and scope, a reason for concern for many citizens.


This article takes a look at the most recent data breach in South Korea, which has affected over 70 percent of the population aged 15 to 65. The compromised data comes from website registrations for various games and online gambling promotions, ringtone storefronts and move ticketing.

CIPP Exam Preparation

In preparation for the Certified Information Privacy Professional/Information Technology (CIPP/IT) exam, a privacy professional should be comfortable with topics related to this post, including:

  • Personally identifiable information (I.A.c.i.)
  • Data encryption (III.D.e.)

Leave a Reply




You can use these HTML tags

<a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>