[Exclusive] Personal Information Leaked at Multicampus... PIPC: "Breach Report Received"

Personal information of approximately 70,000 customers exposed...including names, phone numbers, and email addresses

A personal information breach caused by hacking has occurred at Multicampus, a subsidiary of Samsung SDS that specializes in corporate employee training.

According to IT industry and financial sector sources on November 12, unauthorized external access to the “Learning Platform,” an online employee training service operated by Multicampus, took place on November 9. On the night of November 11, shortly after becoming aware of the personal information breach, Multicampus notified its client companies and reported the incident to the Personal Information Protection Commission.

Multicampus logo. Multicampus

A Multicampus representative said, “We confirmed unauthorized access to the cloud environment used for the Learning Platform and notified our clients.”

The breach is reported to have exposed the personal information of approximately 70,000 customers who use the Learning Platform. The compromised information included names, phone numbers, email addresses, department names, employee numbers, IDs, ranks, and positions. The specific scale of the breach and the types of personal information exposed will be confirmed after an investigation. A Personal Information Protection Commission official said, “We are currently conducting a preliminary review after receiving the report of the personal information breach.”

Multicampus is an education company affiliated with Samsung Group and a subsidiary of Samsung SDS that provides employee training and talent development services to businesses and public institutions. Its main business is designing training courses for companies and supplying content, learning platforms, and training operations services. It is also the domestic operator of OPIc, an English speaking proficiency test.

Given the large number of companies that have entrusted employee training to Multicampus, the fallout from this personal information breach is expected to be significant. According to figures released by Multicampus, it has served approximately 16,000 clients in South Korea and abroad over the past five years. Its clients include 96% of large business groups in South Korea, and the cumulative number of learners over the past 10 years exceeds 26 million. Multicampus has also been entrusted with employee training by major Samsung Group affiliates. As of last year, transactions with Samsung affiliates accounted for approximately 49% of Multicampus's total revenue.

Meanwhile, the hacking incident at Multicampus has raised concerns that the personal information of employees at financial companies, including banks, may also have been exposed. Some financial companies that entrusted online training to Multicampus have become aware of the incident and are responding. After receiving notice from Multicampus, commercial banks began investigating the facts through their in-house training departments. However, the specific scale of the impact on financial company employees has not yet been confirmed.

A banking industry official said, “Banks generally impose strict personal information protection obligations on service providers when signing contracts to outsource online training. We have conducted on-site inspections to check whether security measures are properly implemented and whether personal information is destroyed after the outsourced work is completed,” adding that the matter is being reviewed.

This content was produced with the assistance of AI translation services.