The personal information of about 24,000 employees of Korea Electric Power Corporation (한국전력공사; KEPCO) was exposed on an external website. KEPCO disclosed the incident on Sunday, saying it became aware of the exposure at around 3:59 p.m. on Thursday and had notified affected employees. According to KEPCO, sensitive information such as resident registration numbers and customer information stored in a separate system were not among the leaked data.

Background and context

The key point in this incident is KEPCO’s explanation that employee information was exposed externally, but customer information was not compromised. KEPCO said it manages customer information in a separate system and that this information was not affected. The scope of the incident currently confirmed should therefore be considered in two parts: employee personal information and customer information.

However, reports differ on what information was exposed. KEPCO said it was investigating the cause of the incident, and a KEPCO official said the leak did not appear to be related to artificial intelligence. Since the cause has not been established, it is difficult to attribute the incident to any specific technology or method of attack.

KEPCO said it completed the removal of the employee information after discovering that it had been exposed on an external website. Other reports said the company blocked access to the relevant internal system immediately after becoming aware of the exposure and asked the website operator to delete the information, with deletion taking about 32 hours. The fact that the information remained on the external site for some time after the exposure was discovered is an important part of understanding the response and the sequence of events.

What this means

KEPCO employees are the people directly affected. Since information that could be used to identify or contact individuals, such as names and contact details, was exposed, employees should be alert to impersonation attempts or approaches that exploit personal information, even though no actual misuse has been confirmed. This describes a possibility based on the information exposed; it does not mean that such harm has occurred.

For example, even if someone contacts you claiming to be a KEPCO employee, it is safer not to assume they are actually affiliated with KEPCO just because they know information that was exposed. If you are unsure whether a contact is genuine, you can verify it through an official contact channel you already know. However, the information currently available does not indicate whether any impersonation or financial harm has actually occurred.

According to KEPCO, no direct leak of customer information has been confirmed. The fact that customer information was stored in a separate system and was not compromised is important in assessing the scope of this incident. On the other hand, the separation of employee and customer information does not by itself reveal the cause of the employee information exposure or the likelihood of a recurrence.

KEPCO was mentioned alongside reports of recent customer information leaks at major financial institutions, including Hana Bank (하나은행), KB Kookmin Bank (KB국민은행), and Shinhan Bank (신한은행). The continued reports of information leaks at various organizations show why it is important to look not only at whether personal information was exposed, but also at what information was involved and what steps were taken to delete it and notify affected people after the incident was discovered.

Relevant procedures and support information

Reports said KEPCO individually notified employees about the exposure and provided guidance on preventing further harm. It was also reported that KEPCO notified the Personal Information Protection Commission (개인정보보호위원회) and was investigating the circumstances of the exposure together with relevant agencies. This indicates that notification and investigation procedures are underway; the results of the investigation and the specific cause have not yet been confirmed.

KEPCO said it plans to pursue remedies, including compensation for damages, after conducting the necessary investigation when a person reports that harm has occurred or is expected. Affected employees can therefore check the contents of their individual notification and the reporting and inquiry procedures provided by KEPCO. If they have suffered harm or believe harm may occur, they can document the situation and report it through the channel indicated by the company. The materials provided do not specify the application documents or processing deadlines.

Points that differ among reports

Reports differ on the types of information exposed. One report citing KEPCO’s account listed names, job grades, and telephone numbers; another said there were seven categories: names, department affiliations, employee numbers, mobile phone numbers, office telephone numbers, email addresses, and job titles. It is therefore difficult to establish a single definitive list of exposed information based on the reports currently available.

Reports also differ on when the information was deleted. One report said the removal was completed around midnight on Friday, while another said it was deleted at midnight as the date changed to the 3rd, about 32 hours after the exposure was discovered. Both reports place the discovery at around 3:59 p.m. on Thursday, but describe the time of deletion differently.

What is known and what is not yet known

Confirmed facts

  • KEPCO said the personal information of about 24,000 employees was exposed on an external website.
  • KEPCO said it became aware of the exposure at around 3:59 p.m. on Thursday.
  • KEPCO said sensitive information such as resident registration numbers and customer information in a separate system were not leaked.
  • KEPCO said it notified affected employees and was investigating the exact cause of the incident.

What is not yet known

  • What exactly caused the personal information to be exposed on the external website?
  • Has the period during which the information could be accessed, and whether it was actually viewed or misused, been confirmed?
  • Exactly how many employees were affected?
  • What is the final scope of the information exposed, and when was its deletion completed?

What readers can check

  • KEPCO employees can check the contents of the individual notification they received from the company, its guidance on preventing further harm, and the reporting and inquiry channels.
  • If you receive a suspicious contact, do not trust it solely because the sender knows an exposed name or contact detail. It is safer to verify the person’s identity through an official contact channel you already know.
  • Employees who have suffered actual harm or are concerned that harm may occur can check the procedures provided by KEPCO and follow the progress of the investigation and remedies described by the company.

References