ENKR

Malgeunsoft e-learning vendor breach affecting 20+ organisations

Add to my breach check

Made public · 2,370,000 records

What leaked11

Replaceable

  • Password

Hard to replace

  • Mobile number
  • Home or delivery address
  • Email address
  • Employer
  • Other profile data
  • Username

Permanent

  • Connecting information
  • Date of birth
  • Full name
  • Gender
  • Employerorganisation and, at some sites, job title
  • Other profile dataDI, guardian information, employee numbers, site-specific fields; at some client sites lawyer registration numbers, actuary registration numbers and doctor licence numbers · SBS October 6, 2026

To-dos7 · about 2 h in all

  1. Change the leaked password everywhere you reused itabout 30 minfreeStops: account takeover
  2. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  3. Register as an exposed person with the FSSabout 10 minLimits harm from: scam calls (opens in a new tab)
  4. Block new loans and cards in your nameabout 10 minLimits harm from: scam calls (opens in a new tab)
  5. Turn on two-step sign-in for email and bankingabout 15 minfreeLimits harm from: account takeover
  6. Do nowUse an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: account takeover
  7. This weekRemove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home

What happened next18 events

  1. Undetected 2 events3 days · show events
  2. Response 14 eventsNotice in 2 days · show events
  3. RemedyNone on record
  4. Penalty 2 eventsUnder investigation · show events
  5. DisputesNone on record
  1. Announced eight planned measures against recurrence: WAF, separate key management, isolated file storage, per-client data isolation, admin access controls, monitoring, data deletion, training
  2. KISA breach investigation carried out
  3. PIPC opened an investigation, classed internally as a major case; the company reported about 2.37 million records
  4. Third leak report received by PIPC
  5. Individual notices to affected users completed · email, or text where no email was registered
13 more
  1. Customer-centre phone and a member email given for questions and suspected misuse
  2. Lookup page for people who received the notice email
  3. Apology and breach notice signed by the CEO
  4. Client organisations emailed in four rounds; notices to their members sent out
  5. Second leak report received by PIPC
  6. Malgeunsoft: no direct harm, such as financial loss, confirmed so far
  7. Company's full review confirmed that some members' data leaked
  8. Backdoor and spam-SMS files deleted and affected areas reset; change of system keys under way
  9. Two-step authentication, planned for September 30, 2026, switched on at once
  10. Notice of unauthorised system access and a possible leak
  11. Notice says the case was reported to the authorities as the law requires
  12. Attack noticed at 09:35 after the SMS vendor reported abnormal sending
  13. Intrusion began
Company
Malgeunsoft
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
2,370,000 records · approx.; company report to PIPC, being verified

How the facts developed

  1. First press reports of client notices (국방부, 국민권익위, 한국교육시설안전원, 기아 노조, 대한상사중재원); the company reported to PIPC on 09-22, 09-24 and 09-29, and PIPC opened an investigation on 09-30

Sources