HD Korea Shipbuilding and Offshore Engineering: HD Construction Equipment fined 73.5 million won for employee data leak

South Korean Privacy Watchdog Fines HD Construction Equipment for Data Breach Affecting 9,500 Workers

South Korea’s Personal Information Protection Commission (PIPC) has imposed fines totaling 78.3 million won ($56,800) on two companies following a cyberattack that exposed the personal data of over 9,500 workers. The breach occurred in March 2024, when an unidentified hacker exploited vulnerabilities in an affiliate’s server to access sensitive information.

The primary fine of 73.5 million won ($53,200) was levied against HD Construction Equipment, while its affiliate, HD Korea Shipbuilding and Offshore Engineering, received a 4.8 million won ($3,500) penalty. The hacker infiltrated the affiliate’s mobile equipment management server, which lacked proper access restrictions, allowing the attacker to move laterally into HD Construction Equipment’s systems.

The stolen data included names and employee identification numbers of workers from HD Construction Equipment and its contractors. The PIPC’s investigation determined that the companies failed to implement necessary security measures, such as restricting unnecessary system access, which facilitated the breach. The incident underscores ongoing risks in supply chain security and inadequate internal controls.

Source: https://www.koreajoongangdaily.com/business/hd-construction-equipment-fined-735-million-won-for-employee-data-leak/12847134

HD Hyundai cybersecurity rating report: https://www.rankiteo.com/company/hd-hyundai

"id": "HD-1787805533",
"linkid": "hd-hyundai",
"type": "Vulnerability",
"date": "3/2024",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"

{'affected_entities': [{'customers_affected': '9,500 workers',
                        'industry': 'Construction Equipment',
                        'location': 'South Korea',
                        'name': 'HD Construction Equipment',
                        'type': 'Company'},
                       {'customers_affected': '9,500 workers',
                        'industry': 'Shipbuilding and Offshore Engineering',
                        'location': 'South Korea',
                        'name': 'HD Korea Shipbuilding and Offshore '
                                'Engineering',
                        'type': 'Affiliate Company'}],
 'attack_vector': 'Exploited vulnerabilities in affiliate’s server',
 'data_breach': {'number_of_records_exposed': '9,500',
                 'personally_identifiable_information': 'Names, employee '
                                                        'identification '
                                                        'numbers',
                 'sensitivity_of_data': 'High (personally identifiable '
                                        'information)',
                 'type_of_data_compromised': 'Personal data (names, employee '
                                             'identification numbers)'},
 'date_detected': '2024-03',
 'description': 'South Korea’s Personal Information Protection Commission '
                '(PIPC) imposed fines totaling 78.3 million won ($56,800) on '
                'two companies following a cyberattack that exposed the '
                'personal data of over 9,500 workers. The breach occurred when '
                'an unidentified hacker exploited vulnerabilities in an '
                'affiliate’s server to access sensitive information.',
 'impact': {'data_compromised': 'Names and employee identification numbers',
            'financial_loss': '78.3 million won ($56,800) in fines',
            'identity_theft_risk': 'High (employee identification numbers '
                                   'exposed)',
            'legal_liabilities': 'Fines imposed by PIPC',
            'systems_affected': 'Mobile equipment management server, HD '
                                'Construction Equipment’s systems'},
 'initial_access_broker': {'entry_point': 'Affiliate’s mobile equipment '
                                          'management server'},
 'investigation_status': 'Completed (PIPC investigation)',
 'lessons_learned': 'Supply chain security risks and inadequate internal '
                    'controls (e.g., lack of access restrictions) can lead to '
                    'data breaches.',
 'post_incident_analysis': {'root_causes': 'Lack of proper access '
                                           'restrictions, unnecessary system '
                                           'access, supply chain '
                                           'vulnerabilities'},
 'recommendations': 'Implement proper access restrictions, enhance supply '
                    'chain security, and conduct regular security audits.',
 'references': [{'source': 'Personal Information Protection Commission '
                           '(PIPC)'}],
 'regulatory_compliance': {'fines_imposed': '78.3 million won ($56,800)',
                           'regulations_violated': 'South Korea’s Personal '
                                                   'Information Protection Act',
                           'regulatory_notifications': 'PIPC investigation'},
 'threat_actor': 'Unidentified hacker',
 'title': 'South Korean Privacy Watchdog Fines HD Construction Equipment for '
          'Data Breach Affecting 9,500 Workers',
 'type': 'Data Breach',
 'vulnerability_exploited': 'Lack of proper access restrictions, unnecessary '
                            'system access'}