Another large-scale data breach has emerged in South Korea, with Shinhan Card disclosing that the personal information of about 190,000 customers, mostly small business owners, was leaked through an internal incident.
Shinhan Card, the credit card unit of Shinhan Financial Group, said Tuesday it had reported the case to the Personal Information Protection Commission after confirming the leak. The affected individuals were store owners affiliated with Shinhan Card’s merchant network, businesses where Shinhan Card-holders can make payments.
“The personal data of ordinary cardholders were not affected,” a Shinhan Card official said, noting that merchants and card customers are managed as distinct customer pools.
In most cases, the leaked data involved mobile phone numbers, while some records also contained names, birth dates and gender. The company said no resident registration or credit card numbers were exposed.
Shinhan Card said the breach was not caused by a cyberattacks, but by an internal leak. A company employee was found to have improperly accessed and used the data for credit card solicitation activities, it said, adding that there was no indication of further exposure risk.
According to the company, the leak was first identified on Nov. 12, after the data protection authority requested a review following a tip-off. An internal investigation that followed found that information related to 192,088 stores, including business names and contact details, along with the aforementioned personal information of store owners, had been compromised.
No financial or other damage has been reported so far, Shinhan Card said, but it pledged compensation if any harm is later confirmed.
The company also apologized for the incident and said it would conduct a thorough investigation and impose strict disciplinary measures on those responsible.
The case comes amid a string of high-profile data breaches in Korea, including hacking incidents at major mobile carriers and e-commerce platforms. Among financial firms, Lotte Card earlier this year reported that nearly 3 million customer records had been leaked in a cyberattack.
jwc@heraldcorp.com
