Lock&Lock, a manufacturer of plastic products such as airtight containers, leaked the personal data of about 1.3 million members and will have to pay an administrative fine in the 500 million won range.

The Personal Information Protection Commission announced on the 9th that at the 13th plenary session held the previous day, it imposed an administrative fine of 503 million won and an administrative penalty of 5.4 million won on Lock&Lock, where personal data was leaked. The Commission resolved to have the dispositions publicly posted on the website of each company.

According to the Commission investigation, a hacker exploited a security vulnerability in the mail server of Lock&Lock in April 2024 to infiltrate the internal system, and in late May of the same year exfiltrated the member database (DB). In November of the same year, the intruder reentered the internal system and additionally leaked business documents and employee personal data.

It is understood that the personal data of about 1.3 million people (names, mobile phone numbers, addresses, and more) and 1,111 records of employee personal data (copies of resident registration cards, driver licenses, bankbook copies, and more) were taken out. Lock&Lock did not properly detect or respond to the abnormal high-volume traffic generated during the leak and recognized the leak only belatedly after receiving a threatening email from the hacker.

It was also confirmed that Lock&Lock failed to update a security vulnerability disclosed in 2022 and violated multiple safety obligations, such as applying the same password to administrator accounts of key servers. In addition, it was found that the company did not destroy employee personal data and purchaser information from closed stores (49,466 records).

On the same day, the Commission also imposed an administrative fine of 168 million won and an order to publicly disclose the sanction on Ubase, a call center outsourcing company where the personal data of 1,852 people was leaked. Ubase operated its administrator page in a way that allowed access from outside and had not separately implemented a secure authentication method. Sunphoto, a seller of photo and video equipment where the personal data of 170,000 people was leaked, was also fined 30 million won.

The Commission stated, “Recently, due to negligence in basic safety measures such as insufficient access control for personal information processing systems and failure to apply secure authentication methods, leakage incidents continue to occur” and urged, “Restrict access privileges to personal information processing systems by Internet Protocol (IP) address and other means, and when external access is required, apply additional authentication methods.”