2026.10.30. The Fair Economy — The Personal Information Protection Commission (PIPC) decided to impose a total fine of 3.885 billion won (about $2.8 million) on education company Daekyo and Young Hoon Medical Group after web vulnerability attacks leaked the personal information of about 840,000 members. Daekyo will pay 3.255 billion won (about $2.33 million), while Young Hoon Medical Group will pay 630 million won (about $450,000). The PIPC also ordered Daekyo to publish the details of the penalty on its website.
The PIPC announced on the 29th that it approved these penalties at its 21st plenary session on the 28th, finding that both companies had violated their obligations to take safety measures for personal information.
Daekyo operates education services such as Nunhoyi and Chi Hong, while Young Hoon Medical Group runs Daejeon Sun Hospital and Yuseong Sun Hospital. The PIPC ordered Daekyo to strengthen safety measures for its personal information processing systems and improve its response system for data breach incidents.
Daekyo was hacked twice, in August 2024 and in February 2025, leaking the names, dates of birth, mobile phone numbers, and connecting information (CI) of about 650,000 members of its online education service "Macadamia". The hackers exploited a web vulnerability on an affiliate's website to upload a web shell and run malicious code.
Daekyo had allowed unnecessary direct access from an affiliate's web server to its member database. Even after a security monitoring firm flagged suspicious activity during the first breach, the company failed to properly analyze or block it, and its chief privacy officer (CPO) also neglected to check whether its internal management plan was being carried out.
In March 2024, a SQL injection attack on a hospital website leaked the user IDs, passwords, names, mobile phone numbers, and dates of birth of 188,481 members. The foundation had routinely included a membership registration function on websites that assist with hospital guidance and reservation applications.
It had not installed a web firewall and had not conducted vulnerability checks or input validation. Passwords were encrypted using an insecure algorithm without applying a salt value, making it possible to decrypt some of them. The PIPC ordered the organization to regularly check for vulnerabilities and make improvements.
PIPC Chairperson Song Gyeong-hui said of Daekyo at the plenary session, "I think the company's security management was far too lax given the scale of personal information it collects and the size of the company."
The new fine standards under the revised Personal Information Protection Act, which took effect on September 11, do not apply to these penalties. The revised law raised the cap on fines for major or repeated violations from 3% to a maximum of 10% of total revenue, but it does not apply retroactively to incidents that occurred before its implementation. The 2024 and 2025 incidents involving Daekyo and Young Hoon Medical Group are being handled under the previous standards.
0 Comments
No comments yet.