Signs of a personal data breach have been detected on the website of Noran Usan, a small-business mutual aid program run by the Korea Federation of SMEs with about 1.92 million subscribers.
The Korea Federation of SMEs said Saturday that a notice posted on the Noran Usan website disclosed that "an abnormal access by an unauthorized external party occurred on Nov. 11, and it has been confirmed that some customers' personal information may have been viewed by a third party during that process."
The personal data potentially exposed includes full names, the first seven digits of resident registration numbers, mobile phone numbers, home addresses, home phone numbers, email addresses, and consent status for text message and email communications.
However, the federation said the remaining digits of resident registration numbers are stored in encrypted form, and that the actual scope of data accessed and the specific items involved may change depending on the results of the investigation.
The Korea Federation of SMEs reported the breach to the Korea Internet & Security Agency and said it has blocked the IP address used in the attack and tightened its security policy since becoming aware of the incident.
The federation said it will operate a dedicated channel to receive reports of damage and will proceed with relief procedures for affected subscribers.
"We will promptly confirm whether data was actually accessed and the full extent of any damage, and take all necessary measures to prevent a recurrence," the federation said. "We sincerely apologize for the concern this has caused."
The federation also urged subscribers to take precautions against further harm, warning them not to respond to calls or text messages from anyone impersonating Korea Federation of SMEs or Noran Usan officials and demanding money or loans. It also asked subscribers not to comply with any calls or messages requesting them to enter or change their user IDs or passwords.
sjpark@heraldcorp.com
