More than 100 million records containing personal and financial information from customers of three major South Korean credit card companies were stolen when an employee of the Korea Credit Bureau illegally copied the data to a USB drive and sold it to telemarketers. The leak revealed weaknesses in how the companies protected sensitive customer information, as employees could easily access the data, USB storage was not restricted, and information was retained for over 30 years instead of being deleted after five years as required by law. It also exposed a lack of security culture as most companies saw data protection as an unnecessary expense rather than a critical business function.

1. The Big Leak
The Personal Data Leak in South Korea
© trythis2that

2. More than 100million personal data
of three credit card customers
were stolen
© trythis2that

3. KB Kookmin
Nonghyup
Lotte
ADDRESS
PERSONAL ID NO.
MOBILE PHONE NO.
CREDIT CARD NO.
EXPIRY DATE
BANK ACCOUNT NO.
ANNUAL INCOME
Data included personal information
and financial details
© trythis2that

4. KCB* employee illegally copied all the clients’ info
to his USB and sold it to telemarketers
*KCB: Korea Credit Bureau, Personal credit rating firm developing fraud detection
system (FDS) for the three credit card companies
© trythis2that

5. PROBLEM
#1
Credit Card Companies’ Lack of Understanding
the Importance of Data Protection
It was easy for any employees to access customers’ personal data. Also, they did not
strictly control the usage of private data storage tool, such as USB.
© trythis2that

6. PROBLEM
#2
Credit Card Companies’ Violation to
Personal Data Protection Law
According to the law, they need to discard their customers’ personal data
within five years. However, they had kept the data over 30 years.
© trythis2that

7. PROBLEM
#3
Absence of Security Culture
Most companies do not acknowledge that data protection is a significant part of their
business. Furthermore, they consider data protection as an expense, not an investment.
© trythis2that

8. Works Cited
Experienced Alameda-Contra Costa County Can Help. Photograph. n.d. Domestic
Violence Restraining Orders – Questions Answered. HANNAH E. SIMS, LL.M. Web.
3 Feb. 2014.
Five-components-of-data-protection-strategy. Photograph. 17 Dec. 2013. What Is Data
Protection. Ibdaa. Web. 3 Feb. 2014.
Invedu. “The Big Leak.” Korea Investors Protection Foundation Official Blog. Korea
Investors Protection Foundation, 23 Jan. 2014. Web. 3 Feb. 2014.
Password Security. Photograph. 14 June 2012. Comment: Building a Risk-aware, Cyber
Secure Culture. Infosecurity. Web. 3 Feb. 2014.
Yu, Kun-ha. “What it takes to safeguard personal information.” The Korea Herald. The
Korea Herald, 2 Feb. 2014. Web. 3 Feb. 2014.
© trythis2that