Two entities were sanctioned for security breaches resulting from web vulnerabilities (SQL injection, webshell) on systems considered secondary, highlighting the importance of vigilance extended to the entire IT perimeter.

Facts and context

The South Korean data protection authority, the Personal Information Protection Commission (PIPC), issued two sanction decisions against Daekyo company and the Younghoon Medical Foundation, including fines totaling 3,885,000,000 KRW (approximately €2,590,000) for serious failures in their security obligations.

These two cases originated from personal data breach notifications that led the authority to open investigations.

Reasons for the decision

Regarding Daekyo company:

• Obligation to ensure the security of processing: Daekyo allowed direct and unnecessary access between the web server of an affiliated company and its own member database. An attacker exploited a vulnerability on this affiliated server to deposit a webshell and exfiltrate data of 650,000 people in two phases, in August 2024 and February 2025. The authority noted that the company had been alerted to suspicious activity by its security monitoring provider after the first attack but took no analysis or blocking measures, allowing a second identical attack to occur. Finally, it was found that the data protection officer failed in their supervisory duty by not verifying the application of the internal management plan related to access control.

Regarding the Younghoon Medical Foundation:

• Obligation to ensure the security of processing: The Younghoon Medical Foundation operated an auxiliary website (information, appointment booking) on which it collected data via a registration form "out of habit," without justifying its necessity. An attacker exploited an SQL injection flaw to steal data of 188,481 members. The investigation revealed the absence of basic security measures, such as a web application firewall to detect and block such attacks, vulnerability analyses, or input field validation. Moreover, user passwords were encrypted using an insecure algorithm without adding a "salt," making some of them decryptable.

Authority's decision

Consequently, the authority imposed a fine of 3,255,000,000 KRW (approximately €2,170,000) on Daekyo company.

Consequently, the authority imposed a fine of 630,000,000 KRW (approximately €420,000) on the Younghoon Medical Foundation.

Furthermore, the authority ordered Daekyo to strengthen the security measures of its systems, review its incident response process, and publish the sanction on its website. The Younghoon Medical Foundation was ordered to implement periodic vulnerability analyses and apply necessary patches.

Lessons learned

This decision reminds that:

• The security perimeter is not limited to main information systems but must include all interconnected systems, including those of affiliated companies or auxiliary websites, which can be entry points for attackers.
• The collection of personal data, notably via "habitual" registration features on websites, must be systematically questioned in light of the data minimization principle.
• The absence of response to a security alert and a failure of supervision by the data protection officer on the effective implementation of internal management plans constitute serious breaches that can lead to the repetition of identical incidents.