Article body
GS Retail has been fined around 12.8 billion won due to a large-scale personal data leak incident. The Personal Information Protection Commission announced on the 31st that GS Retail violated the Personal Information Protection Act and imposed a fine of 12.836 billion won along with an additional penalty of 3 million won. It has been confirmed that the personal data of approximately 1.66 million users of GS SHOP and GS25 was leaked in this incident.
The hacker executed a credential stuffing attack on the GS SHOP and GS25 websites, successfully logging in and stealing personal information through the member information modification page. The leaked information includes names, genders, birthdates, contact numbers, addresses, and emails. According to the investigation by the Personal Information Protection Commission, GS Retail did not have security measures in place to detect and block large-scale login attempts and failed to recognize the surge in login attempts and failures.
GS Retail first identified the personal data leak on the GS25 website on January 4 of last year, but it was not until a month later that they realized a similar attack was occurring on GS SHOP. In addition to the fines imposed on GS Retail, the Personal Information Protection Commission issued corrective orders for the establishment of security policies to identify abnormal access and the allocation of dedicated personnel for personal information protection. Similar measures were also taken against Enrise, SK Telecom, and Atoz.