[Money Talks] Wolf Boy’s Warning… What is the difference between potential leak and leak?

# 1. “Don’t say anything until it’s confirmed.”

Until now, domestic companies' response to personal information infringement incidents has always been 'silence'. Representative examples include leaks from telecommunication companies that acknowledged infringement only after tens of millions of pieces of customer information were put up for sale, and large-scale e-commerce/platform incidents that were kept quiet for months, downplaying system errors and hacking situations as simple exposures.

Corporations and financial companies remained silent until the legal responsibility and scope of the leak were finalized. Users received the notice only after being exposed to secondary damage such as voice phishing, smishing, and account theft.

# 2. Recently, Mr. A, who is in charge of human resources at a mid-sized manufacturing company, could not put down the phone all day because of a notice posted on the company website. The notice stated that there was a possibility that resident registration numbers, account numbers, and family information could be leaked, and employees were inundated with calls. When asked, "Are you saying my information was leaked?" Mr. A said, "When I read it again, it said 'possible leak' rather than 'leak,' and there was no way to explain the difference."

The revised Personal Information Protection Act, which went into effect last September, mandates that information subjects be notified within 72 hours if there is a possibility of a leak, even if it has not been confirmed. This system was put to the test two months after its implementation.

In the case of Company B, which supplies accounting and human resources programs to companies, when a personal information infringement incident occurred, many companies and organizations that use the company's services successively announced the 'possibility of leak' on their websites in accordance with the revised law.

The purpose of the system is to block companies' concealment practices and alert them to risks at an early stage to preemptively prevent any secondary damage. However, as notices pour in simultaneously and are released in real time, fear and anxiety are spreading in the market, wondering if new leaks are occurring every day.

Company B is a consignee that has other companies or institutions as its clients. The company confirmed that some encrypted data had been exported through a vulnerability in the backup solution, reported it to the relevant authorities, and notified its customers.

According to the revised law, customer companies also have an obligation to inform information subjects, so they posted notices with this content. An accident at one consignment company led to a notice from customers, and it did not mean that several new accidents occurred.

The main content of the notice is to inform of the possibility of backup service leakage, and the items listed in the notice are within the potential scope and do not mean that all of them have been leaked.

The trustee's responsibility is not light simply because it has been confirmed that the data entrusted to the client company has been exported. An answer must also be given as to why the backup data of the customer whose contract ended was left behind. This is because the principle that the ledger entrusted by the customer remains the customer's until the end cannot be shaken.

However, the notification system must be established as a signal of preparedness rather than a signal of anxiety.

If the wolf boy's frequent alerts cause fatigue, the user becomes insensitive when a real crisis arises. If probability is misinterpreted as 'confirmed' and the number of notices is misinterpreted as 'scale of damage', the subjects get lost and the market misvalues ​​the risk.

What data subjects need is not vague anxiety, but clear guidance on what their information covers and what they should do now.

For this reason, companies should not think that they have fulfilled their obligations by announcing the possibility. We must inform the end of what has been confirmed and what has been resolved.

Authorities that operate the system also need to establish detailed standards to distinguish between ‘possible notification’ and ‘confirmed notification’ to prevent the spread of anxiety.

Caution in the delivery process is also necessary to ensure that the number of notices is not perceived as the scale of damage. Providing accurate facts is as important as early warning. Anxiety and doubts decrease in the presence of accurate information.