The Incheon Metropolitan Government (Mayor Park Chan-dae) has begun determining the circumstances and taking follow-up measures after being informed by relevant authorities that the personal data of some of its former and current employees—retained without authorization by an outside development vendor—had been leaked through a hacking incident. The leaked information was confirmed to be the resident registration numbers of some employees as recorded in 2013.
 [코리안투데이] A view of the Incheon Metropolitan Government building © 장형임 기자 |
The Incheon Metropolitan Government said that on September 5 it was notified by relevant authorities that an outside development vendor connected to city work had retained, without authorization, data containing the personal information of some employees who had previously worked for Incheon City, and that this data had been hacked. Immediately after the notification, the city, together with the relevant authorities, began working to establish the precise circumstances and to take follow-up measures.
After verifying the facts, the city found that the information held and leaked by the outside vendor consisted of the actual resident registration numbers of some employees as recorded in 2013. In accordance with the relevant laws, the city plans to notify the data subjects of the leak within 72 hours. Because a resident registration number is a unique identifier that is difficult to change, its leak can lead to secondary harm, making prompt notification and protective guidance for the data subjects essential.
As of now, however, there is no confirmation that Incheon City provided the vendor with resident registration numbers or other personal information. The circumstances under which the vendor came to acquire and retain the personal data, the timing of the server hacking, and whether the data was accessed or taken out externally—along with the scope of any such access—are being verified through investigation and inquiry by the relevant authorities.
Immediately after becoming aware of the incident, the city carried out emergency protective measures, including blocking the leak route, deleting the data in question, reviewing unauthorized access logs, and changing access credentials. It also plans to review the overall personal data management systems not only internally but also across outside vendors, to prepare follow-up measures to prevent similar incidents from recurring, and to request an investigation into the outside vendor responsible for the leak. The case is seen as underscoring the need to overhaul management systems as a whole, in that the scope of review has expanded beyond information directly managed by the administrative agency to include the personal data management practices of outside vendors involved through service contracts and development work.
An official from the Incheon Metropolitan Government said, ‘We deeply apologize for the concern caused by this incident involving our employees personal data,’ adding, ‘We will actively cooperate with the investigation and inquiry by the relevant authorities to establish the precise circumstances, and we will do our utmost to prevent further harm and strengthen our personal data protection system to ensure this does not happen again.’
지역 홍보대사 신청 기자양성과정 신청 코리안투데이 지부장 신청 코리안투데이 인천강화코리안브랜드대상 신청 최고경영인대상 신청 소비자만족도대상 신청
<저작권자 ⓒ 코리안투데이(The Korean Today) 무단전재 및 재배포 금지>
