Golf Zone personal information was stolen through hacking.

Golf Zone, whose personal information of 2.21 million people was stolen through hacking, was fined 7.5 billion won.

The Personal Information Protection Committee held its 8th general meeting on the 8th and announced on the 9th that it imposed a fine of 7.54 billion won and a fine of 5.4 million won on Golf Zone for violating personal information protection laws and passed a corrective order and public announcement order. .

Golfzon suffered a ransomware attack from hackers in November last year. In this process, the hacker stole the virtual private network account information of Golf Zone employees and remotely accessed the file server within the business network. Then, the files stored on the file server were leaked and released on the dark web.

As a result, personal information such as names, phone numbers, emails, dates of birth, and IDs of more than 2.21 million service users and executives and employees stored on file servers within the business network were leaked. In some cases, resident registration numbers (5,831 people) and account numbers (1,647 people) were also leaked.

The results of the Personal Information Committee's investigation revealed that Golfzon was not aware that a large amount of personal information, including resident registration numbers, was stored in the file server used by all employees. The operation of the management system, such as periodic inspection of the file server where personal information files were stored, was also insufficient.The company introduced a new virtual private network as the number of people working from home increased due to COVID-19. This means that although external access to the internal business network was allowed using only ID and password, the security threats related to personal information leakage within the business network were not reviewed and necessary safety measures were not taken.

In addition, it was confirmed that resident registration numbers, etc. were stored and stored on a file server without being encrypted. There was also a violation of failing to destroy personal information of at least 380,000 people that became unnecessary, such as when the retention period had expired or the purpose of processing had been achieved.

The Personal Information Commission decided to impose a fine on Golfzon for violating the safety measure obligation under Article 29 of the Personal Information Protection Act and for failing to comply with the obligation to destroy personal information under Article 21.Corrective actions were ordered to establish and implement an internal management plan, comply with safety measures, and provide periodic personal information protection training to all employees, and to announce these facts on the website.