ENKR

LG Uplus customer-authentication-system breach

Add to my breach check

Made public · 297,117 records

What leaked7

Hard to replace

  • Mobile number
  • Home or delivery address
  • Email address
  • Other profile data
  • Username

Permanent

  • Date of birth
  • Full name
  • Other profile dataUSIM serial number and the remaining fields of 26

To-dos4 · about 45 min in all

  1. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  2. Register as an exposed person with the FSSabout 10 minLimits harm from: scam calls (opens in a new tab)
  3. Block new loans and cards in your nameabout 10 minLimits harm from: scam calls (opens in a new tab)
  4. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home

What happened next27 events

  1. Undetected 3 eventsabout 4 yr 7 mo · show events
  2. Response 13 eventsNotice in 8 days · show events
  3. Remedy 3 eventsEnded · show events
  4. Penalty 8 eventsFine ₩6.8B · show events
  5. DisputesNone on record
  1. Said KRW 64 billion of the KRW 105 billion annual security budget was committed by June
  2. Corrective order: stronger CPO role, expert privacy organisation, new internal management plan, system-wide checks
  3. Administrative fine of KRW 27 million
  4. Penalty surcharge of KRW 6.8 billion
  5. 297,117 records, 26 fields, leaked from the customer authentication system (CAS) around June 2018; end-of-life software, missing or misconfigured firewall/IPS/WAF, web shells left since 2009 and 2018
22 more
  1. Offered DDoS outage compensation: 10x outage time for about 4.27M individual internet/IPTV subscribers · May bill, one month's fees for affected small businesses, tiered pay for 2,099 PC cafés; extra intake until May 11, 2023Closed May 11, 2023
  2. Second apology after the government results
  3. Asked for quarterly vulnerability checks, real-time monitoring and security equipment, a security organisation under the CEO, and security staff and budget at competitors' level
  4. Joint investigation result: 297,117 customers' data leaked from the customer-authentication DB around June 2018; default admin password, web vulnerability, weak DB access control; 68 routers exposed · DDoS
  5. Offered the spam-call alert app to all customers
  6. Free USIM replacement in stores for notified customers · MVNO included; others from March 1, 2023 via website
  7. Damage-support centre opened for small businesses and PC cafés hit by the DDoS outages
  8. Planned free USIM replacement for all customers, free spam-call alert service, and a damage-support council with outside experts
  9. Cyber safety plan: CISO/CPO under the CEO, annual security investment to be raised about threefold to KRW 100 billion
  10. The CEO apologised at a press conference for the leak and the outages
  11. MSIT warned LG Uplus management and expanded the joint team into a special inspection team from 6 February 2023
  12. Notice of about 110,000 more people, found in separately kept data of former customers; total about 290,000
  13. MSIT and KISA began on-site investigation with a public-private joint team
  14. Apology in the website notice
  15. Individual notices by email and text message
  16. Website notice of a leak affecting about 180,000 customers
  17. Reported the incident to KISA and other agencies
  18. Asked the police cyber unit to investigate
  19. Obtained 600,000 records of leaked customer data from the hacker · date per MSIT
  20. Website lookup to check whether one's data leaked
  21. Post on an illicit site offering LG Uplus customer data (claimed 20M records) for 6 bitcoin
  22. Intrusion began
Company
LG Uplus
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
297,117 records · deduplicated; PIPC

How the facts developed

  1. PIPC decision: 297,117 records, 26 fields, leak around June 2018; 과징금 68억원, 과태료 2,700만원
  2. Notice of about 180,000 customers; raised to about 290,000 people in February 2023 (press)

Sources