Korea's PIPC fines Daekyo and a hospital group KRW 3.9bn

Korea's PIPC fines Daekyo and a hospital group KRW 3.9bn

29 October 2026: South Korea's Personal Information Protection Commission (PIPC) has fined two organisations a total of KRW 3,885,000,000 for failing to take the safety measures the Personal Information Protection Act requires, after attacks that exposed the data of more than 800,000 people. The education company Daekyo was fined KRW 3.255 billion and the Younghoon Medical Foundation, which runs two hospitals in Daejeon, KRW 630 million. The decisions were taken at the commission's plenary meeting of 28 October.

Not yet independently verified. The PIPC release is in Korean and we read it in Korean; the romanised company and hospital names are ours, and no English version of the release was found. We will update this when it can be confirmed, and remove this note.

Daekyo: a web shell on an affiliate site

Daekyo, known for its Noonnoppi and Chaihong learning brands, lost the names, dates of birth, phone numbers and connecting information (CI, Korea's identity-linking code) of about 650,000 members. Attackers planted a web shell on the site of an affiliated online service, macadamia, in August 2024 and again in February 2025. Besides the fine, the PIPC ordered corrective measures and ordered Daekyo to publish the fact that it had been sanctioned.

A hospital group and an SQL injection

The Younghoon Medical Foundation runs Daejeon Sun Hospital and Yuseong Sun Hospital. An SQL injection attack in March 2024 exposed 188,481 members' IDs, passwords, names, phone numbers and dates of birth. The PIPC fined the foundation KRW 630 million.

Both cases are about basic web application security rather than novel attacks: a web shell is a script left on a server that gives an attacker a foothold, usually through an upload or an unpatched component, and SQL injection is one of the oldest flaws on the list. In Daekyo's case the way in was an affiliate's site rather than the main service, which is why the fine covers the company's safeguards across both.

Customer service checks across nine firms

The PIPC published a second release the same day on an advance inspection of how nine companies, among them Coupang, CJ ENM, G-Market and SK Broadband, plus four call-centre operators, handle personal data in customer service. That was an inspection with recommendations, not a fine: the commission asked for masking rules for agents' screens and set out four rules of conduct for staff handling customer records.

For firms operating in Korea, the two releases together give a short list: inventory every web property that touches the member database, including old campaign and affiliate sites; test them for injection and upload flaws; and limit what customer service agents can see to what the call needs.

Sources

• PIPC: press release on penalties for Daekyo and Younghoon Medical Foundation (Korean), 29 October 2026
• PIPC: advance inspection of customer service personal data handling (Korean), 29 October 2026