Korea privacy watchdog fines Daekyo, Young Hoon Medical Foundation 3.88 billion won over data leaks

South Korea's Personal Information Protection Commission said Thursday it had fined Daekyo and the Young Hoon Medical Foundation a combined 3.88 billion won ($2.91 million) for failing to protect members' personal data in two separate breaches, ordering both operators to tighten security and publicly disclose the penalties.

The commission said Daekyo, which runs the online education service Macadamia alongside its offline tutoring businesses, must pay 3.25 billion won ($2.44 million), while the Young Hoon Medical Foundation, which operates Daejeon Sun Hospital and Yuseong Sun Hospital, was fined 630 million won ($471,451). Both were found to have violated the security obligations set out in Article 29 of the Personal Information Protection Act.

At Daekyo, the regulator found that a hacker had uploaded a web shell through a vulnerability on an affiliated company's website and used it to reach the member database of Macadamia. The intruder struck twice, in August 2024 and again in February 2025, and stole the names, dates of birth, mobile phone numbers and identifying connection information of about 650,000 people.

The commission found that Daekyo had allowed an unnecessary direct connection from the affiliate's web server to its own member database, a path the attacker used both times. It also determined that the company had been warned by a security monitoring firm of suspicious activity after the first breach but did not properly analyze or block the intrusion. The company's chief privacy officer was also faulted for failing to check whether internal management plans, including access controls, were actually being carried out. The commission ordered Daekyo to strengthen security on its data systems, overhaul its breach response procedures and post notice of the penalty on its website.

At the Young Hoon Medical Foundation, the attacker exploited an SQL injection vulnerability on a hospital website in March 2024 and extracted the user IDs, passwords, names, mobile phone numbers and dates of birth of 188,481 members. The commission said the foundation had collected the data through a routine sign-up function on a website used for hospital information, message boards and appointment requests, even though the site existed only to support hospital operations.

The foundation had no web firewall capable of detecting and blocking such attacks, had not checked its site for SQL injection or other vulnerabilities, and had not built in validation of what users typed into its input fields, the commission found. It also used an outdated encryption algorithm and did not apply salt values, leaving some passwords reversible. The commission ordered it to conduct regular vulnerability checks and fix the problems it finds.

The commission said a breach could originate not only from the systems running a company's main services but also from servers connected to affiliated companies or from websites that merely support day-to-day operations. It urged businesses to review whether they still need sign-up features at all, to minimize the personal data they collect, and to test their sites for well-known attacks such as web shells and SQL injection while strengthening detection of abnormal activity.

The penalties were decided at the commission's 21st plenary meeting on Wednesday.