It was confirmed on the 30th that personal data of residents of some apartments built by GS E&C leaked in a hacking incident. Whether it is linked to the recent string of hacks centered on the financial sector has not been confirmed.
According to Kyunghyang Shinmun, GS E&C told residents in a notice on the 30th that the apartment community facility reservation management system had been accessed without authorization from outside and that a personal data leak had been confirmed. The number of complexes and residents affected was not disclosed.
광고 문의 · 300×250Timeline and data that may have leaked
The company said unauthorized access began around 10:15 p.m. on the 28th, and that it spotted signs of abnormal access at 11:29 p.m. and blocked it at once. Log analysis then confirmed the unauthorized access. It is still determining which customers were affected and how far.
Items that may have been exposed include name, nickname, date of birth, mobile number, gender, email, address, member number, housing type, password, administrator ID, household head status, sign-up and login records, and the RF card number used for building entry. The company said resident registration numbers, account numbers and card numbers were not collected or stored and so are not included. Actual leaked items may differ by customer.
GS E&C said it blocked the external IP addresses, applied security policies and reported the incident to the relevant authorities. It urged residents to watch for smishing, voice phishing and requests for personal information, and to change passwords. Questions can go to the Xi integrated customer center or by email.
Link to the financial-sector hacks
Kyunghyang Shinmun reported on the 28th that leaks from external hacking had spread to securities firms, asset managers and a crypto exchange, with 20 companies reporting. The Financial Supervisory Service reportedly shared with financial firms on the 21st that large-scale access attempts from suspected North Korean IP addresses had been detected. But whether the GS E&C incident came from the same attacker or used the same methods could not be confirmed in this reporting.
Because resident apps and facility reservation systems hold names, contact numbers and addresses together, experts have repeatedly warned that such data can be abused in text-message fraud. Anyone who reuses a password across sites should change it first and avoid clicking links of unknown origin.
