Report of 2.37 million pieces of personal information leaked due to Malgunsoft hacking... About 20 victimized organizations

(Seoul = Yonhap News) Reporter Cha Min-ji = Malgunsoft, an online education site operator, was found to have reported that about 2.37 million pieces of personal information of its customer members were leaked due to hacking.

While damage has been confirmed in more than 20 places, including the Anti-Corruption and Civil Rights Commission, the Ministry of National Defense, the Korea Educational Facilities and Safety Institute, and the Kia Workers' Union, the impact is growing as the leaked information includes information related to identity verification, such as linkage information (CI), which serves as the so-called 'online resident registration number', and duplicate registration confirmation information (DI).

According to data submitted by the Personal Information Protection Committee to the office of Social Democratic Party lawmaker Han Chang-min, a member of the National Assembly's Political Affairs Committee, on the 13th, the scale of personal information leaks reported by Malgunsoft was approximately 2.37 million.

However, this is based on company reporting, and the Personal Information Commission is confirming the exact scale of the leak.

Reported leaked items include the client company's member ID and password (encrypted), mobile phone number, email, address, gender, and date of birth.

CI, DI, guardian information, and information set by the customer for each site are also included.

Malgunsoft is a company that supplies online learning management systems (LMS) to companies and public institutions, and has been entrusted with managing the systems and personal information of customer education sites.

When an education system operator was attacked, personal information from several customers was stolen at once.

The confirmed victims so far are known to be about 20, including the Ministry of National Defense, the Anti-Corruption and Civil Rights Commission, and the Korea Food and Drug Administration.

The personal information of about 100,000 users was leaked from the Integrity and Civil Rights Learning Center operated by the Anti-Corruption and Civil Rights Commission, and about 40,000 users were leaked from the online education system of the Korea Educational Facility Safety Institute.

The information leaked from both places included name, affiliation, date of birth, address, email, ID, and password.

The names, employee numbers, and phone numbers of approximately 5,000 union members at the Kia Gwangmyeong plant were also stolen.

According to the company's apology, an external attacker first illegally accessed the education site server at 2:47 p.m. on the 19th of last month and stole personal information at 10:04 a.m. the next day.

Malgunsoft became aware of the leak after receiving notification that a spam text message had been sent from a customer's text message (SMS) account at 9:35 a.m. on the 22nd of last month.

The Personal Information Commission received reports of leaks from Malgunsoft three times on the 22nd, 24th, and 29th of last month and began an investigation on the 30th.

The Personal Information Commission is said to have classified the Malgunsoft leak incident internally as an 'important incident'.

Rep. Han Chang-min pointed out, "Malgeun Soft is ranked first in the industry in the field of operating domestic online cloud education systems," and added, "We cannot rule out the possibility that personal information was leaked from all organizations that entrusted work to Malgeun Soft, in addition to the Civil Rights Commission."

At the same time, he emphasized, “There is a need for a government-wide survey of online services and platform companies where large-scale personal information is inevitably concentrated.”