HD Hyundai affiliates fined over 9,500 personal data leaks

The Personal Information Protection Commission (PIPC) has imposed fines on two HD Hyundai affiliates following a data breach that exposed the personal information of 9,503 employees and partner staff.

In March 2024, an unidentified hacker exploited a vulnerability in a mobile device management server operated by HD Korea Shipbuilding & Offshore Engineering. By uploading a web shell file, the attacker gained access to the server and subsequently moved into the internal business system of HD Construction Equipment, which was connected to the initial server despite having no operational necessity for such access.

The breach resulted in the leak of names and employee identification numbers. Consequently, the PIPC issued a fine of 73.5 million won to HD Construction Equipment and an administrative fine of 4.8 million won to HD Korea Shipbuilding & Offshore Engineering for failing to implement adequate security measures and access controls between affiliated systems.