ENKR

Golfzon ransomware data breach

Add to my breach check

Made public · 2,210,000 people

What leaked7

Hard to replace

  • Bank account number
  • Mobile number
  • Email address
  • Username

Permanent

  • Resident registration number
  • Date of birth
  • Full name
  • Resident registration number5,831 people
  • Bank account number1,647 people

To-dos6 · about 50 min in all

  1. Block new loans and cards in your nameabout 10 minStops: loans or cards in your name · Limits harm from: scam calls (opens in a new tab)
  2. Block non-face-to-face account opening in your nameabout 10 minStops: bank account in your name · Limits harm from: scam calls (opens in a new tab)
  3. Register as an exposed person with the FSSabout 10 minLimits harm from: scam calls, loans or cards in your name, bank account in your name (opens in a new tab)
  4. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  5. Check your credit records and block status on credit4uabout 10 minfreeHelps you notice: loans or cards in your name (opens in a new tab)
  6. Report the lost resident ID card on Gov24about 5 minLimits harm from: bank account in your name (opens in a new tab)

What happened next18 events

  1. Undetected 2 events1 day · show events
  2. Response 11 eventsNotice in 21 days · show events
  3. RemedyNone on record
  4. Penalty 5 eventsFine ₩7.5B · show events
  5. DisputesNone on record
  1. Said it is raising information-security investment fourfold from the previous year
  2. Corrective order (internal management plan, safeguards, CPO role, staff training) and publication order
  3. Administrative fine of KRW 5.4 million for failing to destroy personal data · Art. 21
  4. Penalty surcharge of about KRW 7.5 billion for breach of the safeguard duty · Art. 29
  5. A VPN allowed ID/password-only access to the internal network, where a file server lacked safeguards; over 2.21M users and staff leaked, incl. resident registration numbers of 5,831 and bank accounts of 1,647
13 more
  1. Text messages to members saying name and mobile number were in the stolen files
  2. Disclosed the leak in a website notice
  3. Stolen Golfzon data (539 GB archive) posted on the group's dark-web leak site
  4. Apology to customers for the data leak
  5. Notice on strengthened intrusion detection and access control, investigation by a security firm
  6. PIPC said it would assign a division and open an investigation
  7. Emergency recovery of the service outage completed
  8. Apology to customers and store owners for the service outage
  9. Official statement naming ransomware as cause and saying no member data leaked
  10. Website, mobile app and Golfzon Market put under emergency maintenance
  11. Ransomware infection hit Golfzon's servers
  12. Intrusion began
  13. Leak report received by PIPC
Company
Golfzon
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
2,210,000 people: service users and employees · PIPC: 약 221만명 이상; RRN of 5,831 people and bank account numbers of 1,647 people

How the facts developed

  1. PIPC decision itemises RRN and bank-account subsets; 과징금 75억 400만원, 과태료 540만원
  2. Leak notice after the December 8, 2023 dark-web posting

Sources