The National Security Council unveils the contents of the plenary session on the 26th
GS Retail’s “Best to strengthen the security system and prevent recurrence.”
The Personal Information Protection Committee imposed a fine of 12.8 billion won on GS Retail, where 1.66 million people’s personal information was leaked. Accordingly, GS Retail announced that it will thoroughly inspect the security system and management system after the accident and take steps to prevent a recurrence.
The National Security Council announced on the 31st that it decided to impose a fine of 12.836 billion won and a fine of 3 million won on GS Retail for violating personal information protection laws at a general meeting on the 26th.
According to the National Security Commission’s investigation, unidentified hackers attempted a “credential stuffing” attack on the GS Shop website from June 21, 2024 to February 13, last year, and on the GS25 website from December 26, 2024 to January 4, last year. Credential stuffing is a method of trying to log in by substituting IDs and passwords obtained from other sites into various services.
After successfully logging in, the hacker accessed the membership information modification page and took out the personal information of 1.581,025 GS Shop members and 79,128 GS25 members. The leaked information included name and gender, date of birth, contact information, address and email.
The problem is that GS Retail did not properly detect it during the large-scale attack. The Personal Information Commission pointed out that there were no security measures in place to detect and block repeated login attempts on the same IP in a short time. Although there were abnormalities in the number of login failures and successes that increased rapidly, the attack continued for a long time without being aware of them in a timely manner.
GS Retail first recognized the leakage of personal information on the GS25 website on January 4 last year, but only found out about a month later in February that the same attack was being carried out at GS Shop. Of the IPs used in the GS25 attack, 327 were also used in the GS Shop attack, but they failed to prevent further damage.
The management system for personal information protection has also come under fire. At the time of the accident, there was no organization dedicated to personal information and security operations were dualized. After the initial notification of the leak, 1,599 additional victims were identified during the investigation by the Personal Information Commission, but they were notified of the leak beyond the legal deadline of 72 hours without justifiable reasons.
The Personal Information Commission imposed fines and fines on GS Retail and at the same time required the disposition to be announced on its website. In addition, it has prepared measures to prevent recurrence, such as security policies that can identify abnormal access, and ordered the deployment of personnel in charge of personal information protection. The privacy governance system was also improved, such as clarifying the authority and responsibility of the personal information protection officer (CPO).
GS Retail apologized for the personal information leakage accident and said it is strengthening its security system.
GS Retail said, “We apologize once again for the concern caused by this personal information leakage accident,” adding, “Since the accident, we have thoroughly checked the security system and management system and strengthened the level of information protection.”
He then formed an “information security countermeasure committee” involving major executives and external experts to upgrade the security response system, and explained that he is continuing efforts to prevent recurrence, such as training employees and maintaining internal management systems, with company-wide personal information protection as a major management task from the customer’s top priority.
An official from GS Retail said, “We will do our best to protect customer information and prevent the recurrence of personal information leakage.”
