"Unauthorized access to outsourced vendor's server"... The Born Korea announces possible personal information leak

Breach of Douzone Bizon's backup service occurred on Oct. 26

The Born Korea said that unauthorized external access to a backup server managed and operated by an outside service provider may have resulted in the leakage of personal information.

On Nov. 2, The Born Korea posted a notice on its official website titled "Notice on the Possibility of Personal Information Leakage at Douzone Bizon and Preventive Measures."

The Born Korea said it learned on Oct. 26 from Douzone Bizon, which handles maintenance of the enterprise resource planning (ERP) system used by its employees, about unauthorized external access to a backup service and the possibility that personal information had been leaked.

According to The Born Korea, Douzone Bizon detected unusual activity at around 2 p.m. on Oct. 26 while inspecting the service. It then learned from the backup solution provider that there was a security vulnerability and conducted an internal investigation. During the investigation, it found indications that some encrypted data on the backup server had been taken outside through the vulnerability.

Information that may have been exposed includes business partners' email addresses, phone numbers, bank names, account numbers and account holders' names. It also includes the names, resident registration numbers, addresses, contact details and account numbers of current and former employees. Information related to customer inquiries includes names, mobile phone numbers, email addresses, inquiry details and store addresses.

However, The Born Korea said that all of the information was encrypted and that whether personal information had actually been leaked, as well as the identities of those affected, had not yet been confirmed in detail.

The Born Korea emphasized that the incident occurred on a backup server managed and operated by Douzone Bizon and was unrelated to any personal information leakage from its online services. It also said that a personal information leak had not been confirmed and that it had issued the notice as a precaution to prevent secondary harm.

Immediately after becoming aware of the incident, Douzone Bizon forcibly shut down the affected server and took additional security measures, including blocking access from overseas Internet Protocol (IP) addresses. It said it had promptly reported the incident to the Korea Internet & Security Agency (KISA) and would fully cooperate with investigations by the relevant authorities.

A representative of The Born Korea said, "As soon as whether the information was actually leaked and who was affected are confirmed, we will promptly issue individual additional notices or corrected notices."

This content was produced with the assistance of AI translation services.