Child rights agency sanctioned after losing 1.17 million records of adoptees, missing children

Korea's privacy watchdog sanctioned a state child rights agency for losing digital records containing 1.17 million records on adoptees and missing children on Thursday.

The Personal Information Protection Commission said Thursday it had imposed an 863 million won ($623,600) penalty and a 22.2 million won administrative fine on the National Center for the Rights of the Child, a public institution under the Ministry of Health and Welfare. It also issued a correction order, recommended disciplinary action and ordered the outcome be made public.

The center lost a CD containing 1.14 million records on adoptees and others, including resident registration numbers, names, addresses and contact details. It also lost an external hard drive holding 30,000 records on missing children, including resident registration numbers, names and the dates and places where they went missing.

The center had kept both devices in office cabinets and drawers without assigning a manager or keeping logs of when they were taken out and returned, the commission found. It could not tell investigators when or how either device was lost.

The center also skipped security and data integrity checks when it stored files submitted with applications for certificates confirming adoption in the same database table. The flaw allowed adoptees and prospective adoptive parents who were assigned the same serial number to view all of the documents each other had submitted. Names, dates of birth and sex were exposed for 47 people: 37 adoptees and 10 prospective adoptive parents.

The center failed to properly notify those affected and report the breach within 72 hours of learning of it, the commission said.

"We will deal strictly with personal information breaches at public institutions and respond firmly, including by recommending disciplinary action, when institutions delay or fail to issue breach notifications," the commission said.

The commission separately penalized two HD Hyundai affiliates over a 2024 breach, with penalty surcharges totaling 73.5 million won and administrative fines totaling 4.8 million won.

A hacker began the intrusion around March 2024 by uploading a malicious file to a mobile device management server run by HD Korea Shipbuilding & Offshore Engineering, the intermediate holding company for HD Hyundai's shipbuilding business. The hacker then used that server to reach an internal business system at HD Hyundai Construction Equipment, which became HD Construction Equipment in January after merging with HD Hyundai Infracore.

The hacker took names, employee identification numbers and other personal information belonging to 9,503 employees and contractor workers.

Weak safeguards on the shipbuilding company's device management server allowed it to be used as the route into the other company's system, the commission found. The two systems had no business need to be connected, but the companies had not restricted access between them.

"This breach happened because personal data processors neglected vulnerabilities in their personal information systems and failed to control unnecessary server access," a commission official said. "Personal data processors should regularly review security measures and restrict access rights to personal information systems to block and control unnecessary access."

BY MOON HEE-CHUL [[email protected]]