South Korea's privacy regulator has fined education company Daekyo 3.255 billion won after two cyberattacks exposed the personal information of about 650,000 users, in a ruling that also fined a hospital operator over a separate breach.

The Personal Information Protection Commission said on 29 October that it held a plenary meeting the previous day and imposed fines totalling 3.885 billion won on Daekyo and Younghoon Medical Foundation, along with corrective orders and orders to disclose the penalties. Younghoon Medical Foundation was fined 630 million won.

Two breaches, one missed warning

Daekyo, which operates education brands including Noonnoppi and Chaihong, suffered breaches in August 2024 and February 2025 in which the names, dates of birth, mobile phone numbers and connecting information of about 650,000 online education service members were exposed.

The commission's investigation found that an attacker exploited a web vulnerability on the website of a Daekyo affiliate to install a web shell capable of executing malicious commands, then used it to steal personal data. MLex reported that the company failed to properly respond to security alerts after the first attack and allowed unnecessary access to the database.

Seoul Economic Daily reported that the commission also found Daekyo's chief privacy officer did not properly implement management plans and assessments related to privacy protection measures, including access control, which contributed to the breach.

Hospital case shows the same pattern

Separately, Younghoon Medical Foundation, which operates two hospitals, was fined after a March 2024 SQL injection attack exposed information on 188,481 website members. Investigators identified inadequate protection against web attacks and insecure password encryption, according to MLex.

The leaked data in the hospital case included usernames, passwords and names. The regulator issued corrective orders to both organisations.

Sources: Seoul Economic Daily; MLex