The operator of the Yellow Umbrella mutual aid program has apologized after detecting unauthorized access that may have allowed a third party to view some customers’ personal information. The Korea Federation of SMEs said the abnormal access occurred on Nov. 11 through the program’s website and that the scope of any exposure remains under investigation.
Yellow Umbrella has about 1.92 million registered members, primarily small business owners preparing financially for closure or old age. That membership figure describes the size of the program, not the number of confirmed victims. The federation has not established whether information was actually viewed or disclosed how many members may have been affected.
Information potentially visible during the incident included names, the first seven digits of national identification numbers, mobile phone numbers, home addresses, home telephone numbers and email addresses. Records of consent to receive text messages and emails may also have been accessible. The federation said the remaining digits of national identification numbers were stored using an irreversible encryption method.
The available evidence does not explain how the intruder obtained access or whether any records were copied. Without those findings, the incident cannot yet be described as a confirmed leak affecting all members. The federation said it would determine whether customer information was viewed, assess the number of people involved and introduce measures intended to prevent another intrusion.
Members warned about impersonation attempts
Even an incomplete set of contact and identity details could help criminals make fraudulent messages or calls appear credible. Members may receive communications that reference the program, their contact information or other personal details. Such familiarity would not prove that a message came from the federation or from an authorized Yellow Umbrella representative.
The federation advised members not to respond to anyone claiming to represent the program who asks for money, offers or demands a loan, or requests that account credentials be entered or changed. Members should independently verify suspicious contacts rather than using links or telephone numbers supplied in an unsolicited message. The central unresolved points are whether records were actually accessed, how many members were involved and what method was used in the intrusion.