A basic security flaw, consisting of not decommissioning a file server after a data migration, caused a massive data breach leading to the sanction of four companies within the same group for multiple cascading violations.

Facts and context

The South Korean data protection authority, the Personal Information Protection Commission (PIPC), issued a sanction decision against four companies of the Samyang group (Samyang Holdings Inc., Samyang Corporation, Samyang Packaging, and Samyang Data System Inc.), including a total fine of 568,200,000 South Korean won (approximately €378,800) for serious breaches of security, retention, and lawfulness obligations.

The case originated from a cyberattack in July 2022, during which an unauthorized third party exfiltrated a large volume of personal data after exploiting a vulnerability on a mail server to gain access to an internal file server.

Grounds for the decision

The investigation revealed that the compromised server had been used for a data migration and should have been decommissioned but remained connected to the external network. The attacker was thus able to exfiltrate about 850,000 files (1.3 TB) containing data of 149,767 individuals, including 82,750 national registry numbers. The authority found several violations:

• Obligation to ensure the security of processing: The authority found that Samyang Data System Inc., acting as a processor, failed its security obligation by leaving a file server, used for a completed data migration, connected to the external network. Furthermore, the other three group companies, as controllers, had not implemented encryption measures for the stored national registry numbers, which significantly worsened the consequences of the breach for the data subjects.
• Obligation of retention limitation: It was established that Samyang Holdings Inc. and Samyang Packaging retained information on daily workers' wages beyond the legally applicable retention period, violating the principle of storage limitation.
• Obligation of lawfulness and data minimization: The investigation showed that Samyang Holdings Inc. collected national registry numbers of candidates during recruitment without a valid legal basis to justify this collection.
• Obligation to regulate processing by contract: The three controllers had entrusted processing activities to Samyang Data System Inc. since July 2022 but only formalized this relationship by a written contract in December 2024, well after the security incident occurred.

Authority's decision

Consequently, the authority imposed an administrative fine totaling 552,000,000 South Korean won and a penalty fine of 16,200,000 South Korean won, amounting to a total of 568,200,000 South Korean won (approximately €378,800) on the companies concerned.

Additionally, the authority ordered Samyang Data System Inc. to take corrective measures to comply with its security obligations.

Lessons learned

This decision reminds that:

• Managing the lifecycle of IT assets is a cornerstone of data security; any server or system no longer in use, even temporarily, must either be decommissioned or completely isolated from external networks.
• Encryption of particularly sensitive personal data, such as national identification numbers, is a fundamental technical security measure to mitigate risks in case of a security perimeter breach.
• The formalization of a processing contract compliant with legal requirements must imperatively precede any data processing by a processor and not be regularized afterwards, especially after a security incident.