Korea privacy watchdog issues rules as AI-driven hacking spreads

The Personal Information Protection Commission issued a set of personal data protection rules for the public and for companies and institutions, citing a rise in hacking that uses artificial intelligence to probe security weaknesses and growing concern over leaks and the secondary harm that follows them.

The commission's guidance splits into habits for individuals and pre-emptive checks for organisations. For the public it advises closing unused accounts and turning on two-factor authentication wherever a site or app offers it, along with keeping unnecessary personal details off social media.

It also asks people to check periodically, through public services such as the "Find My Leaked Information" tool, whether their account credentials or identity have been compromised, and to change the password on any other site that shares a password already exposed. Links arriving in unfamiliar text messages, calls or emails should not be opened before the sender is verified through an official website or app.

Personal data infringement can be reported to the Personal Information Protection Center on 118, voice phishing and smishing to the police's integrated response unit on 1394, and financial fraud to the police on 112 or to the relevant financial company's customer service center to request a payment suspension.

Companies and institutions are told first to map their information assets: servers, network-attached storage, network equipment, devices and installed software including version numbers, together with the types and volume of personal data each system handles and its external connections. Homepages, systems and accounts that are unused or have sat unattended should be deleted or disabled, and temporary or test systems and unused external access ports should be checked and closed off.

Organisations should identify external application programming interface connections and retire those no longer used, limit access rights and personal data lookup ranges to the minimum for each interface, block abnormal bulk or repeated requests, and immediately recover authentication credentials such as keys and tokens left unused for long periods.

Protection measures should be reviewed regularly with weaknesses fixed promptly, and response procedures and a designated chain of responsibility should be prepared and kept under constant review for when a leak occurs.

"Personal information protection requires both the responsible protective measures of companies and institutions and practice in daily life by individuals," Vice Chairperson Lee Jung-ryul said. He asked individuals to follow the safeguards and companies and institutions to check for vulnerabilities in advance to reduce leaks and secondary damage.