South Korea Fines Education Provider & Hospital Group $2.91 Million Over Data Security Failures

Key Takeaways

• $2.91 Million in Penalties: South Korea's Personal Information Protection Commission fined Daekyo and Young Hoon Medical Group approximately $2.91 million (KRW 3.885 billion) for violations of security requirements under the Personal Information Protection Act.
• Repeated Breach at Daekyo: Attackers exploited the same vulnerabilities in August 2024 and February 2025, compromising information belonging to approximately 650,000 users after the company failed to take adequate action following the first incident.
• Privacy Oversight Failures: Investigators found that Daekyo's chief privacy officer had failed to adequately supervise internal security measures, particularly access controls.
• Hospital Website Vulnerabilities: Young Hoon Medical Group was fined approximately $471,600 (KRW 630 million) after an SQL injection attack exposed personal information belonging to 188,481 users, with investigators also identifying inadequate password protections.

Deep Dive

Daekyo had been warned. In August 2024, after hackers exploited vulnerabilities in websites operated by its affiliates, the South Korean education provider received a report of suspicious activity from its security monitoring contractor. The company failed to investigate adequately or close the weaknesses that had allowed the intrusion. Six months later, attackers exploited the same vulnerabilities again.

The failures have now cost Daekyo approximately $2.44 million (KRW 3.255 billion), the larger of two penalties imposed by South Korea's Personal Information Protection Commission (PIPC) following investigations into breaches that exposed the personal information of approximately 838,500 people.

The commission also fined Young Hoon Medical Group, which operates two medical centers, approximately $471,600 (KRW 630 million) after finding that weaknesses in its websites and password protections contributed to a separate breach affecting 188,481 users. Together, the penalties amount to approximately $2.91 million (KRW 3.885 billion).

At Daekyo, investigators uncovered failures in access controls, incident response and privacy oversight. At Young Hoon Medical Group, attackers exploited vulnerabilities in a website supporting hospital operations, reaching personal information that included account credentials, names, telephone numbers and birth dates.

For Daekyo, the commission's findings were particularly damaging because the first attack had already provided an opportunity to identify and correct the weaknesses.

Unknown hackers initially gained access in August 2024 by exploiting vulnerabilities in websites operated by Daekyo's affiliates. They uploaded malicious scripts known as web shells, which allowed them to execute commands on compromised servers and reach databases connected to those systems.

The databases, known as Macadamia, contained information belonging to users of Daekyo's online education services. Across the August 2024 and February 2025 attacks, approximately 650,000 users had personal information compromised, including names, dates of birth, telephone numbers and connection information used to link individuals across different online platforms. Investigators found that Daekyo had permitted unnecessary direct connections to databases containing personal information, leaving them accessible through compromised web servers.

Following the first incident, the company's security monitoring provider reported anomalies that warranted further investigation. Daekyo failed to conduct an adequate analysis, block unauthorized access or implement measures to detect attempts to extract information from its systems. The vulnerabilities remained unresolved when attackers exploited them again in February 2025.

The commission also examined the company's internal supervision of privacy and security measures. It found that Daekyo's chief privacy officer had failed to adequately oversee the implementation of internal management plans, particularly those concerning access controls. The regulator identified that lack of oversight as one of the underlying causes of the incident.

The findings placed responsibility beyond the immediate technical weaknesses. Daekyo had received information about suspicious activity, yet the measures needed to investigate the intrusion and prevent its recurrence were not adequately carried out.

Alongside the approximately $2.44 million (KRW 3.255 billion) fine, the commission ordered Daekyo to strengthen protections for its personal information processing systems and overhaul its company-wide incident response framework. The company must also publish the results of the sanctions on its website. The investigation into Young Hoon Medical Group concerned a different attack, but one that similarly began with weaknesses in a public-facing website.

In March 2024, unknown hackers exploited SQL injection vulnerabilities in a website operated by the medical group, which runs Daejeon and Yuseong Sun Medical Centers. The breach compromised personal information belonging to 188,481 users, including user IDs, passwords, names, telephone numbers and birth dates.

SQL injection allows attackers to manipulate database operations by introducing malicious commands through vulnerable website inputs. Properly designed applications can prevent such attacks by controlling how submitted information is processed.

Young Hoon Medical Group operated websites supporting hospital services, including information for visitors and appointment bookings. These systems collected and processed personal information, but investigators found that the organization had not implemented adequate protections against attacks targeting its websites.

The medical group had failed to install and operate a web application firewall or establish other sufficient measures to detect and block attacks exploiting website vulnerabilities. It had also neglected to address SQL injection weaknesses and configure its applications to properly validate information entered by users. The deficiencies extended to password protection.

According to the commission, Young Hoon Medical Group used insufficiently secure algorithms to protect passwords submitted during website registration. It also failed to incorporate salts, random values added during password hashing to make stored credentials more resistant to recovery.

Without those protections, some passwords could have been vulnerable to recovery following the breach. The commission did not establish that attackers had successfully recovered the original passwords.

The PIPC imposed a fine of approximately $471,600 (KRW 630 million) and ordered the medical group to regularly assess its websites for vulnerabilities and implement appropriate security measures for its personal information processing systems.

The regulator's findings illustrate the exposure that can arise from websites performing routine business functions. An appointment portal or registration system may appear peripheral to an organization's principal operations, but the information it collects and the databases it can reach make its security consequential. The commission urged organizations to examine whether membership registration functions are necessary and to avoid collecting personal information that is not required to provide their services.

It also called for regular assessments of website vulnerabilities, stronger detection of unusual activity and improved responses to attacks involving web shells and SQL injection.

Those recommendations reflect the failures identified in the two investigations. Young Hoon Medical Group had not adequately protected its websites against known attack methods or secured stored passwords. Daekyo had allowed unnecessary access to databases and failed to respond adequately to suspicious activity identified after an earlier intrusion.

The commission's findings concerning Daekyo's chief privacy officer add another dimension. Internal security plans provide little assurance if those responsible for supervising them do not establish whether the required controls have actually been implemented.

That responsibility becomes more immediate when a potential intrusion has already been detected. Security monitoring can identify suspicious activity, but the work of investigating what happened, determining whether unauthorized access remains possible and correcting the underlying weakness still has to be done.

At Daekyo, the interval between the two attacks was approximately six months. The commission found that the company had not taken the necessary follow-up measures during that period. The second breach was the consequence of vulnerabilities that had survived the first.

The regulator's corrective orders now require both organizations to address the deficiencies uncovered during their investigations. For Daekyo, that includes changes to the broader incident response framework, reflecting the commission's conclusion that the failures reached beyond the security of individual systems.

The GRC Report is your premier destination for the latest in governance, risk, and compliance news. As your reliable source for comprehensive coverage, we ensure you stay informed and ready to navigate the dynamic landscape of GRC. Beyond being a news source, the GRC Report represents a thriving community of professionals who, like you, are dedicated to GRC excellence. Explore our insightful articles and breaking news, and actively participate in the conversation to enhance your GRC journey