South Korea Fines Government Agencies $187K Over Data Breaches Linked to Security Failures
On May 28, 2026, South Korea’s Personal Information Protection Commission (PIPC) imposed fines totaling 281 million won ($187,000) on the Ministry of the Interior and Safety for security lapses that exposed sensitive personal data through its Government24 and Shared Nuri public service portals. The breaches stemmed from source-code errors, insufficient testing, and unresolved authentication vulnerabilities, allowing unauthorized access to records including education documents, tax certificates, resident registration details, and internal contact files via Google search.
In a separate incident, the Rural Development Administration, two affiliated agencies, and contractor MisoTech were also penalized for a breach affecting 575,000 records, stored on an improperly secured network-attached storage (NAS) system. The PIPC’s findings highlight systemic failures in access controls, vulnerability management, and third-party oversight within government digital infrastructure. Official statements on the sanctions were released in Korean.
MisoTech TPRM report: https://www.rankiteo.com/company/misotech
Rural Development Administration TPRM report: https://www.rankiteo.com/company/rural-development-administration
Ministry of the Interior and Safety TPRM report: https://www.rankiteo.com/company/ministry-of-the-interior-and-safety-republic-of-korea
"id": "minmisrur1779957074",
"linkid": "ministry-of-the-interior-and-safety-republic-of-korea, misotech, rural-development-administration",
"type": "Breach",
"date": "5/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Public Sector',
'location': 'South Korea',
'name': 'Ministry of the Interior and Safety',
'type': 'Government Agency'},
{'customers_affected': '575,000 records',
'industry': 'Public Sector',
'location': 'South Korea',
'name': 'Rural Development Administration',
'type': 'Government Agency'},
{'industry': 'Technology/IT Services',
'location': 'South Korea',
'name': 'MisoTech',
'type': 'Contractor'}],
'attack_vector': ['Source-code errors',
'Insufficient testing',
'Unresolved authentication vulnerabilities',
'Improperly secured NAS system'],
'data_breach': {'number_of_records_exposed': '575,000',
'personally_identifiable_information': 'Yes (resident '
'registration details, '
'internal contact '
'files)',
'sensitivity_of_data': 'High (personally identifiable '
'information, resident registration '
'details)',
'type_of_data_compromised': ['Education documents',
'Tax certificates',
'Resident registration details',
'Internal contact files']},
'date_publicly_disclosed': '2026-05-28',
'description': 'South Korea’s Personal Information Protection Commission '
'(PIPC) imposed fines totaling 281 million won ($187,000) on '
'the Ministry of the Interior and Safety and other agencies '
'for security lapses that exposed sensitive personal data '
'through public service portals and an improperly secured NAS '
'system. The breaches involved source-code errors, '
'insufficient testing, unresolved authentication '
'vulnerabilities, and poor access controls.',
'impact': {'brand_reputation_impact': 'Likely negative impact on public trust '
'in government services',
'data_compromised': ['Education documents',
'Tax certificates',
'Resident registration details',
'Internal contact files'],
'financial_loss': '281 million won ($187,000) in fines',
'identity_theft_risk': 'High (exposure of resident registration '
'details and personally identifiable '
'information)',
'legal_liabilities': 'Fines imposed by PIPC',
'operational_impact': 'Systemic failures in government digital '
'infrastructure',
'systems_affected': ['Government24 portal',
'Shared Nuri portal',
'Network-attached storage (NAS) system']},
'investigation_status': 'Completed (fines imposed)',
'lessons_learned': 'Systemic failures in access controls, vulnerability '
'management, and third-party oversight within government '
'digital infrastructure.',
'post_incident_analysis': {'root_causes': ['Source-code errors',
'Insufficient testing',
'Unresolved authentication '
'vulnerabilities',
'Improperly secured NAS system',
'Access control failures',
'Vulnerability management failures',
'Third-party oversight failures']},
'references': [{'source': 'Personal Information Protection Commission '
'(PIPC)'}],
'regulatory_compliance': {'fines_imposed': '281 million won ($187,000)',
'regulations_violated': ['Personal Information '
'Protection Commission '
'(PIPC) regulations'],
'regulatory_notifications': 'Official statements '
'released'},
'response': {'communication_strategy': 'Official statements released in '
'Korean'},
'title': 'South Korea Fines Government Agencies Over Data Breaches Linked to '
'Security Failures',
'type': 'Data Breach',
'vulnerability_exploited': ['Access control failures',
'Vulnerability management failures',
'Third-party oversight failures']}