"Even With Certification, Companies Remain Vulnerable to Hacking Attacks"... Information Security Certification System to Be Overhauled

Under Armour, Coupang, and Lotte Card Hit by Repeated Hacking Incidents
Controversy Grows Over the Effectiveness of ISMS and ISMS-P Certification
Government to Introduce Stronger Review Standards and Supplemental Measures

As incidents of personal information leaks continue to occur at companies certified under the Information Security Management System (ISMS) and the Personal Information & Information Security Management System (ISMS-P), controversy is growing over the effectiveness of the certification system. In response, the government has begun working on improvement measures. The government plans to strengthen the system by expanding the scope of mandatory certification, introducing a technology-focused review process, and enhancing post-certification management.

According to industry sources on March 13, US sportswear company Under Armour recently notified customers of a personal information leak.

Under Armour stated, "We became aware that, around November 2025, an unauthorized external intruder accessed Under Armour's IT systems and obtained certain customer personal information." The company added, "Immediately upon detection, we began an investigation with external cybersecurity experts to determine the nature and scope of the breach, as well as the types of personal information affected." Under Armour further explained, "On or around February 12 of this year, it was confirmed that personal information including customer email addresses and certain customer names and gender-related information were affected," and clarified, "Not all customer information was exposed."

Under Armour is a company holding valid ISMS certification until March 7, 2029. However, as large-scale personal information breaches continue to occur at companies certified under ISMS and ISMS-P, criticism has arisen that the certification system does not reflect the actual security capabilities of companies. The Personal Information Protection Commission previously revealed that, as of December last year, 33 personal information leak incidents had occurred at 27 out of 263 companies certified with ISMS-P over the past five years.

Notably, Coupang received ISMS-P certification twice, in 2021 and 2024, but suffered four incidents last year, including a leak of approximately 33.7 million pieces of personal information in November. Lotte Card also experienced the leak of personal credit information for 2.97 million people when its online simple payment system was hacked just two days after obtaining ISMS-P certification from the Financial Security Institute last year. Netmarble likewise received ISMS-P certification in 2023 but suffered an incident last year in which around 6.11 million pieces of personal information were leaked after its PC game portal was hacked.

In response, the government has decided to establish and announce a plan to strengthen the effectiveness of the "Information Security and Personal Information Protection Certification System," reflecting feedback from the field. Song Kyunghee, Chairperson of the Personal Information Protection Commission, stated at a policy discussion held the previous day, "We must build a structure where a certain level of protection measures is continuously maintained, rather than being satisfied with a certificate issued at the time of review," and emphasized, "To restore trust in the certification system, we must overcome the limitations of the snapshot approach, which assesses the state of security based on a single review at a specific point in time."

Going forward, the government plans to classify certification into three risk-based levels: simplified, standard, and enhanced. In particular, strong certification standards will be applied to high-risk groups such as telecommunications companies and large platforms. In addition, external Internet-connected assets, which are a major cause of security incidents, will be included in the certification scope. This is intended to prevent companies from arbitrarily excluding servers or cloud assets when seeking certification. A pre-assessment stage will also be introduced to check core items—such as password encryption and the latest patches—prior to the main review, in order to block inadequate certifications for unprepared companies in advance.

Furthermore, the government will increase the number of professional technical personnel and lengthen the review period, while also strengthening oversight of review authorities. There are plans to create a legal basis for stronger administrative actions, such as business suspension or cancellation of designation, against review agencies that fail to meet quality standards. In terms of post-certification management, criteria will be established to revoke certification if a significant security incident occurs after certification acquisition or if recommended improvements are not implemented.

Ryu Jemyoung, Second Vice Minister of Science and ICT, said, "As security breaches of all sizes continue to occur, fundamental questions are being raised about the effectiveness of the certification system. By analogy with health, we are reviewing whether the certification system is faithfully serving its role in safeguarding security, much like a health checkup," and added, "We hope that this will serve as an opportunity for information protection standards in Korea to advance to the next level."

This content was produced with the assistance of AI translation services.