ENKR

LG Uplus customer-authentication-system breach

Add to my breach check

Made public · 297,117 records

What leaked7

Hard to replace

  • Mobile number
  • Home or delivery address
  • Email address
  • Other profile data
  • Username

Permanent

  • Date of birth
  • Full name
  • Other profile dataUSIM serial number and the remaining fields of 26

To-dos4 · about 45 min in all

  1. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  2. Register as an exposed person with the FSSabout 10 minLimits harm from: scam calls (opens in a new tab)
  3. Block new loans and cards in your nameabout 10 minLimits harm from: scam calls (opens in a new tab)
  4. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home

What happened next27 events

  1. Undetected 3 eventsabout 4 yr 7 mo · show events
  2. Response 13 eventsNotice in 8 days · show events
  3. Remedy 3 eventsEnded · show events
  4. Penalty 8 eventsFine ₩6.8B · Back to latest
  5. DisputesNone on record

Penalty: 8 events

Back to latest
  1. Corrective order: stronger CPO role, expert privacy organisation, new internal management plan, system-wide checks
  2. Administrative fine of KRW 27 million
  3. Penalty surcharge of KRW 6.8 billion
  4. 297,117 records, 26 fields, leaked from the customer authentication system (CAS) around June 2018; end-of-life software, missing or misconfigured firewall/IPS/WAF, web shells left since 2009 and 2018
  5. Asked for quarterly vulnerability checks, real-time monitoring and security equipment, a security organisation under the CEO, and security staff and budget at competitors' level
3 more
  1. Joint investigation result: 297,117 customers' data leaked from the customer-authentication DB around June 2018; default admin password, web vulnerability, weak DB access control; 68 routers exposed · DDoS
  2. MSIT warned LG Uplus management and expanded the joint team into a special inspection team from 6 February 2023
  3. MSIT and KISA began on-site investigation with a public-private joint team
Company
LG Uplus
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
297,117 records · deduplicated; PIPC

How the facts developed

  1. PIPC decision: 297,117 records, 26 fields, leak around June 2018; 과징금 68억원, 과태료 2,700만원
  2. Notice of about 180,000 customers; raised to about 290,000 people in February 2023 (press)

Sources