Korea Electric Power Corporation said personal information belonging to about 24,000 employees was exposed on an external webpage. The affected records included employees’ names, organizational affiliations and telephone numbers. The utility said resident registration numbers and other sensitive or unique identification data were not included, and it reported no exposure of customer information.
- People affected
- About 24,000 KEPCO employees
- Information exposed
- Names, organizational affiliations and telephone numbers
- Information not included
- Customer records, sensitive data and unique identification numbers
KEPCO identified the exposure at about 3:59 p.m. on October 1. After discovering the incident, the company blocked access to the relevant internal system and asked the operator of the external webpage to remove the information. The exposed data was deleted roughly 32 hours after the company became aware of the incident.
The disclosure creates a practical risk for current employees because names, workplaces and direct contact details can be combined to support targeted impersonation, phishing or unwanted contact. The available evidence does not establish that anyone downloaded or misused the information, however, and KEPCO has not reported a compromise of electricity customers’ records.
The cause remains under investigation
The route by which the employee data reached the external webpage remains unconfirmed. KEPCO has established an emergency response situation room and is conducting its own review alongside relevant authorities. The investigation will need to determine whether the exposure resulted from a system configuration, an access-control failure or another cause, but no specific mechanism has yet been verified.
The next points to watch are the findings on how the information was published, how long it may have been accessible before detection and whether evidence of secondary use emerges. Any additional notification or protection offered to affected employees will also indicate how KEPCO assesses the continuing risk from the exposure.