Hackers breached community facility reservation system

Scope of damage still under investigation

GS Engineering & Construction's headquarters at Gran Seoul in Jongno-gu, Seoul. [GS Engineering & Construction]
GS Engineering & Construction's headquarters at Gran Seoul in Jongno-gu, Seoul. [GS Engineering & Construction]

Personal data belonging to residents of some apartment complexes built by GS Engineering & Construction has been leaked through an external hacking attack, the latest in a string of cyberattacks that have spread from the financial sector to the construction industry.

GS Engineering & Construction sent a notice to affected residents Friday afternoon confirming that "unauthorized external access to the apartment community facility reservation management system" had resulted in a personal data breach, according to industry sources. The hack is believed to have occurred at around 10:15 p.m. Wednesday.

Data potentially exposed in the breach includes residents' names, nicknames, dates of birth, mobile phone numbers, gender, email addresses, home addresses, membership numbers, residency types, passwords, administrator IDs, household registration status, account creation dates, IP addresses and RF card numbers. The specific items compromised vary from customer to customer.

However, the company said resident registration numbers and other unique identification data, as well as core financial information such as bank account and credit card numbers, were not collected or stored in the system and were therefore not among the leaked data.

GS Engineering & Construction is currently notifying affected residents individually, and it is expected to take some time before the full extent of the damage can be tallied. The company said it is continuing to verify which apartment complexes were affected and the precise scope of the breach.

"Upon becoming aware of the incident, we immediately completed emergency measures including blocking external IP addresses, applying security policies and reporting to the relevant authorities," a company official said. "We urge customers to exercise caution regarding smishing, voice phishing and requests for personal information, and recommend changing passwords currently in use."

"We take this matter very seriously and sincerely apologize for the concern caused," the official added. "We will significantly strengthen our personal data protection framework and security standards to prevent a recurrence."


hwshin@heraldcorp.com