Personal Information Protection Commission

Press Release

The PIPC Imposes KRW 3.885 Billion in Administrative Fines on Two Organizations for Failing to Implement Safeguards 

- The PIPC urges organizations to review their membership registration functions, minimize the collection of users’ personal information, regularly assess web vulnerabilities, and strengthen anomaly detection to prevent data breaches

October 29, 2026

(This is an unofficial translation of a press release, originally prepared in Korean.)

The Personal Information Protection Commission (PIPC) held its 21st plenary meeting of 2026 and resolved to impose sanctions on two organizations for their failure to comply with the Personal Information Protection Act (PIPA) on October 28, 2026. The sanctioned businesses are as follows:

● Daekyo: An education service provider, operating flagship brands such as Noonnopi, Caihong, and more

● Young Hoon Medical Group: A medical service provider operating Daejeon and Yuseong Sun Medical Centers

The PIPC’s investigations found that the two organizations failed to put adequate safeguards in place as required under the PIPA. The following explains the details of violations and sanctions imposed.

1. Daekyo: An administrative fine of KRW 3.255 billion, correction and publication orders

In August 2024 and February 2025, unknown hackers exploited web vulnerabilities of Daekyo’s affiliates to upload web shells and execute malicious commands. These two attacks allowed them to access the databases called Macadamia connected to its affiliates’ web servers, resulting in data breaches involving the names, birthdates, phone numbers, and connection information (CI) of approximately 650,000 users of Daekyo’s online education services.

*Web shells are malicious scripts that allow cybercriminals to have access to compromised web servers and execute malicious commands, access the databases, and more. Most often, such hackers exploit vulnerabilities in the website code to deliver malicious scripts. A web shell gives an attacker remote control of a web server, letting them run commands on the server’s operating system. This includes reading, changing, or deleting files and running programs, without a server account or physical access.

*CI: Information used to link users across different platforms

The investigation results showed that Daekyo allowed unnecessary access directly connecting to the databases containing Daekyo’s user information. Following the first incident in August 2024, the company was briefed by its security control service provider regarding anomaly detection results, but it failed to take follow-up measures, including detailed analysis, blocking unauthorized access, and detection of attempts to exfiltrate data. As a result, it led to another data breach exploiting the same security vulnerabilities in February 2025.

Furthermore, Daekyo’s chief privacy officer (CPO) failed to oversee the implementation status of the company’s internal management plans, particularly its access control measures. This lack of oversight was identified as one of the root causes of the incident.

Accordingly, the PIPC imposed an administrative fine of KRW 3.255 billion on Daekyo and issued a correction order to strengthen security measures for its personal data processing systems and overhaul the company-wide data incident response framework. The Commission also ordered the company to publish the sanction results on its website.

2. Young Hoon Medical Group: An administrative fine of KRW 630 million

Unknown hackers exploited Structured Query Language Injection (SQLi) vulnerabilities in a website operated by the Young Hoon Medical Group, resulting in a data breach of 188,481 users, including user IDs, passwords, names, phone numbers, birth dates, and other personal information in March 2024. 

*SQLi is a code injection technique that allows hackers to insert malicious SQL statements into an entry field, resulting in the manipulation of databases.

The PIPC’s investigation results showed that the Group collected and processed personal information through websites that support hospital operations, including hospital information, user guidance, appointment booking services, and more. The Group failed to install and operate a Web Application Firewall (WAF) and implement other measures to detect and block attacks exploiting web vulnerabilities. It also failed to address SQLi and other security vulnerabilities, and configure programs to validate entered values on its websites.

Furthermore, the Group used encryption algorithms that were not secure enough to encrypt passwords submitted by users during website registration. It also failed to add salt to the hashing process, which could expose some passwords to be decrypted as well. 

*A salt is a random value that is added to passwords before they are hashed to ensure that identical passwords generate different hash values. Adding a salt increases the level of encryption.

Accordingly, the PIPC imposed an administrative fine of KRW 630 million on the Young Hoon Medical Group and issued a correction order to regularly assess web vulnerabilities and take necessary measures for its personal data processing system.

3. Key Takeaways

These cases highlight the importance that servers connected to databases and websites that assist major service operations can serve as entry points for cyberattacks and lead to data breaches. Data controllers should therefore regularly identify how personal information is collected, used, and managed across their systems and review safeguards put in place.

The incidents also demonstrate that negligence in taking appropriate measures after detecting security threats, and failure to effectively review the implementation of internal security management plans, can result in repeated data breaches exploiting the same vulnerabilities. It is expected to serve as a wake-up call for data controllers to exercise caution in daily operations to prevent data incidents.

In this regard, the PIPC calls for data controllers to review the necessity of membership registration functions and avoid collecting personal information that is not required for service operations. The PIPC also calls on organizations to strengthen their response frameworks, including web vulnerabilities review, anomaly detection, and others, in preparation for cyberattacks involving web shells, SQLi. 

* A PDF file, formatted for better readability, is attached.