Kia union's 5,000-member data leak traces to a training vendor serving about 20 organizations

Malgnsoft knew by Sept. 20, when it posted a notice on its website that said: "Unauthorized external access occurred to systems we manage for the operation of online education sites" ^[16]. The Kia union was told on Sept. 25 ^[9], six days after the attack and five days after that notice ^[18][19]. Seoul Economic Daily reported that the vendor first ran a full review, and that the union texted all members the following day ^[11]. The union's public statement came on Oct. 7, 18 days after the server was breached ^[14][20].

The 5,000 figure counts one client ^[1]. JoongAng Daily reported that employees at more than 20 organizations whose systems Malgnsoft managed were affected ^[8]. Seoul Economic Daily (which spells the vendor Malgunsoft) said about 20, and counted the Kia union among them ^[3][10]. Both reports name the Ministry of National Defense and the Anti-Corruption and Civil Rights Commission ^[8][10].

"Phone numbers and passwords were stored in encrypted form, so the actual numbers and passwords were not exposed," the union said in its text to members ^[6]. "The phone numbers were leaked in encrypted form, so it is unlikely that actual damage will occur," a union official told Seoul Economic Daily ^[13]. Names and employee ID numbers are not among the fields either statement describes as encrypted ^[4][6]. The union's text told members not to click links in messages from unidentified senders ^[11].

JoongAng Daily placed the leak after recent breaches at the banks KB Kookmin, Shinhan and Hana ^[7]. Seoul Economic Daily wrote that the case extends a run of hacking incidents centered on financial firms and public institutions to the industrial sector ^[15]. Neither report says how the bank breaches happened or how large Malgnsoft is.

Taken as an incident, the Kia case is small: phone numbers and passwords were encrypted and no further damage has been confirmed ^[6]. The vendor case is larger, with one backdoor and one member database serving about 20 clients ^[3][10]. The broadest claim, that outsourced vendors are the common route into Korean institutions, needs the bank cases to fit, and on the reporting they are tied to this one only by date. I think the concentration reading is right and the broadest one is unproven. Against that, if the encryption holds and no misuse follows, the cost of all that concentration was a round of text messages and reports to two agencies ^[17]. The concentration reading fails if the inspections find the attacker reached clients through separate weaknesses. Seoul Economic Daily's account describes a single database ^[3].