LG Uplus ran its login system on dead software — hackers took 297,117 customer files

On 12 July 2023 South Korea's Personal Information Protection Commission sanctioned LG Uplus with a ₩6.8 billion ($5.3M) surcharge and a ₩27 million fine over a breach disclosed that January: hackers had taken 297,117 customers' personal data — names, phone numbers, addresses, birth dates and USIM identifiers among 26 fields. It was the largest surcharge yet imposed on a Korean company for a data leak.

The commission traced the intrusion to a customer authentication system running software that was already end-of-life at the presumed time of the breach, June 2018; basic intrusion-prevention equipment was absent or misconfigured, and webshells uploaded in 2009 and 2018 had sat undiscovered on the servers. More than 10 million production records with personal data were left unattended in development and testing environments.

LG Uplus was also faulted for failing to notify affected customers individually within 24 hours of learning of the leak. The commission ordered it to strengthen the role of its privacy chief, rebuild its internal management plan, inspect its systems comprehensively — and follow through on the information-protection investments it had publicly promised.