KEPCO Discloses Leak of 24,000 Employee Records, Says Incident Unrelated to Recent Bank Hacks

"If damage occurs or is expected and is reported to us, we will conduct the necessary investigation and proceed with remedies including compensation," a KEPCO official said ^[14]. The pledge is the only part of the utility's response with money attached, and it pays per reported case. The roughly 24,000 people on the exposed list ^[1] set the maximum number of claimants. The bill depends on how many of them file and what they can show.

What the file contained keeps that number low. It held names, affiliations and phone numbers, and no unique identifiers such as resident registration numbers ^[2]. Contact details are still enough to start a phishing attempt, and KEPCO has told affected staff to be careful with incoming phone calls, emails and text messages ^[13]. The likeliest losses fall on employees who answer one.

The case for repricing state-linked Korean firms rests on contagion. KEPCO's disclosure follows what Yonhap described as back-to-back leaks of customer data in hacking attacks at Hana Bank, KB Kookmin Bank and Shinhan Bank ^[10]. A state-run power company on the same list invites a wider governance discount. The evidence so far does not connect the cases. A KEPCO official said the company is still verifying the exact cause and that the leak appears unrelated to the AI-related hacking attacks at financial firms ^[11].

The investigation can end three ways. If an employee or a vendor posted a page by mistake, this stays an HR-data incident with phishing risk attached. If the file was pulled from the internal systems that hold employee records, the finding is about access controls at a state utility. The company's first step suggests it took that second possibility seriously: "As soon as we became aware of the situation, we blocked access to internal systems containing employee personal information," the official said ^[5]. A trail back to the bank attackers would overturn the company's early read ^[11] and strengthen the repricing case.

I think the first outcome is the one to price until investigators say otherwise. That means costs limited to the response itself and whatever employee claims arrive. The counter-case is serious. A list pairing 24,000 names with affiliations and phone numbers tells an attacker whom to call in which part of the company ^[1][2]. Evidence of an intrusion, or staff reporting a run of targeted calls, would prove the contained-cost view wrong.

KEPCO's response so far is an emergency response center and a joint investigation with law enforcement ^[8]. It has no customer notice to run, because customer information sits in a separate system and was not compromised ^[9]. Its compensation offer waits for claims ^[14]. It also asked the outside site's operator to take the material down: "We also asked the operator of the external website to delete the exposed information, and it has been removed," the official said ^[6]. Yonhap reported that deletion was completed around midnight Friday ^[7]. The public statement came on Sunday, three days after detection at about 3:59 p.m. on Thursday ^[12].