"Neglect of Personal Information Safeguards" Daekyo, Yeonghun Medical Foundation Fined a Total of 3.8 Billion Won-plus

Daekyo Fined 3.255 Billion Won; Yeonghun Medical Foundation Fined 630 Million Won
Commission Urges Review of Member Registration and Web Vulnerability Checks

The Personal Information Protection Commission said on the 29th that it had imposed a combined 3.885 billion won in fines on two entities, Daekyo and the Yeonghun Medical Foundation, for violating personal information protection laws, and had ordered them to take corrective measures and publicize the sanctions. The entities were found to have caused large-scale personal information leaks by neglecting their duty to implement safety measures under Article 29 of the Personal Information Protection Act.

Song Kyunghee, chairperson of the Personal Information Protection Commission, delivers opening remarks at the 21st plenary meeting held at the Government Complex Seoul on the 28th. Provided by the PIPC.

Daekyo, which operates comprehensive online and offline education services such as Eye Level and Chai Hong, was fined 3.255 billion won. An unidentified hacker exploited a web vulnerability on an affiliate's website to upload a web shell, then executed malware twice, in August 2024 and February 2025. As a result, personal information—including the names, dates of birth, mobile phone numbers, and Connecting Information (CI) of approximately 650,000 people—was leaked from the member database (DB) of Daekyo's online education service, which was linked to the affiliate's web server.

According to the commission's investigation, Daekyo had allowed unnecessary direct access from the affiliate's web server to the member DB. In particular, when the first leak occurred in August 2024, the company received an alert from its security monitoring provider about the detection of suspicious activity. However, it neglected to take response measures, such as conducting a detailed analysis and blocking the activity, and a leak using the same method recurred in February the following year. The company also failed to adequately inspect whether its chief privacy officer (CPO) was implementing the internal management plan. The commission therefore imposed a fine and ordered Daekyo to strengthen its safety measures and improve its response system for personal information leaks. It also ordered the company to publicize the sanctions on its website.

The Yeonghun Medical Foundation, which was fined 630 million won and issued a corrective order, suffered a hacking incident in March 2024. The hacker exploited an SQL injection vulnerability on the hospital's website and stole the personal information of 188,481 members, including their user IDs, passwords, names, mobile phone numbers, and dates of birth. The commission said that the foundation collected personal information through member registration while operating a website to assist with services such as appointment requests, but had not installed or operated detection and blocking systems, such as a web application firewall.

The foundation had also failed to check for web vulnerabilities, including SQL injection, or implement input validation programs. In particular, it used an insecure cryptographic algorithm to encrypt passwords entered during member registration and did not use salt values, leaving some passwords in a state that allowed them to be decrypted. Along with imposing a fine, the commission ordered the foundation to conduct regular vulnerability checks and implement corrective measures.

A commission official said, "This investigation is significant because it confirmed that not only major systems but also servers connected to affiliates and auxiliary websites can serve as routes for data leaks, and highlighted the importance of checking safety measures." The official added, "Please review whether features such as website member registration are necessary to ensure that unnecessary personal information is not collected, and strengthen web vulnerability checks and systems for detecting and responding to suspicious activity."

This content was produced with the assistance of AI translation services.