---
title: "Samyang fined ₩552m: a server left online after a migration leaked 149,767 people’s data"
summary: "South Korea’s privacy regulator’s decision of 11 November: how a file server kept online after a data migration leaked 1.3TB, and what each of four Samyang companies was fined."
url: https://www.thetechbag.com/blog/samyang-fined-552m-won-forgotten-file-server
format: Note
desk: "Data & privacy"
region: Global
published: 2026-11-13
facts_checked: 2026-11-13
author: TechBag (The TechBag Journal)
tags: ["Samyang data breach","Samyang fine","PIPC fine","Korea data breach fine","Samyang Holdings","Samyang Corporation","Samyang Packaging","Samyang Data System","Personal Information Protection Commission","South Korea","resident registration number","data migration","file server","server decommissioning","encryption","data processor","budget mobile carriers","MVNO","penalty surcharge"]
cover: https://www.thetechbag.com/blog/covers/samyang-fined-552m-won-forgotten-file-server.png
---

# Samyang fined ₩552m: a server left online after a migration leaked 149,767 people’s data

*South Korea’s privacy regulator’s decision of 11 November: how a file server kept online after a data migration leaked 1.3TB, and what each of four Samyang companies was fined.*

Note · Data & privacy · By TechBag · Published 2026-11-13 · Facts checked 2026-11-13 · Canonical: https://www.thetechbag.com/blog/samyang-fined-552m-won-forgotten-file-server

South Korea’s privacy regulator has fined three Samyang group companies ₩552m, ₩184m each, because a file server set up to move their data was left connected to the internet after the move was finished. In July 2022 an intruder used it to take about 850,000 files, 1.3TB, holding the personal data of 149,767 people, 82,750 of them with their resident registration numbers.[1] The Personal Information Protection Commission decided the case at its plenary meeting on 11 November and published it on 12 November. It added ₩16.2m in smaller administrative fines, ordered corrections and ordered the decision made public.[1]

149,767

people whose data was taken: employees, shareholders and other contacts

PIPC

82,750

of them with their resident registration number, stored unencrypted

PIPC

1.3TB

about 850,000 files copied to an outside cloud

PIPC

₩552m

fines on three companies, plus ₩16.2m in administrative fines

PIPC

## How a finished migration became the way out

The four companies are Samyang Holdings, the group’s holding company; Samyang Corporation, which makes sugar and flour; Samyang Packaging, a plastic-packaging maker; and Samyang Data System, the group’s IT company, which handled their personal data for them.[1] According to the PIPC, an unidentified intruder used a flaw in a group mail server to gain administrator rights, then stole the login details of an internal file server that had been installed to migrate data. Samyang Data System had left that server able to talk to outside networks from the end of the migration until the attack, which let the intruder move the three companies’ files to an external cloud “in a short period”.[1]

The PIPC found three more failures that made the damage larger. None of the three companies encrypted resident registration numbers, Korea’s lifelong national ID numbers. Samyang Holdings and Samyang Packaging kept day labourers’ pay records past their legal retention period. Samyang Holdings collected resident registration numbers when hiring without a legal basis. And when the leak happened, the three were already having Samyang Data System process their personal data without a written contract; they drew one up only in December 2024.[1]

**Figure: The fine came four years and four months after the leak**

*Samyang group leak and the regulator's decision, by month, July 2022 to November 2026*

| Date | Event | Detail |
| --- | --- | --- |
| Jul 2022 | Files taken | 149,767 people's data from a migration file server left online |
| Dec 2024 | Contract written | the three companies' processing contract with Samyang Data System |
| Nov 2026 | Fines decided | ₩552m in fines and ₩16.2m in administrative fines, published 12 November |

Source: Personal Information Protection Commission, press release of 12 November 2026 · as of 12 November 2026

## Who paid what, and what to check after a migration

Each of the three companies was fined ₩184m and ₩1.8m for the unencrypted numbers and the missing contract. Samyang Holdings and Samyang Packaging were each fined ₩3.6m for keeping data too long, and Samyang Holdings ₩3.6m more for the hiring numbers. Samyang Data System received a corrective order.[1] The PIPC’s advice is short: retire servers that are no longer used or cut them off from outside access, and delete personal data once it is no longer needed.[1]

Our viewA check after any data move

A migration leaves staging servers, copies and accounts behind. Before calling it finished: list every server and storage bucket the project created, shut down or firewall each one from the internet, change or remove the accounts it used, delete the copies, and get it in writing which company processes the data for whom.

At the same meeting the PIPC fined eight budget mobile carriers, including kt M mobile, LG HelloVision and KB Liiv Mobile, ₩171.3m in all. Four of them kept resident registration numbers, card numbers or bank account numbers in plain text.[2]

How we did this

Figures as of 13 November 2026, 8:30pm IST

Every fact about the case is from the PIPC’s press release of 12 November, read in Korean; quotations are our translations. The PIPC describes the leak as July 2022 and gives no exact day, so the timeline shows months. The ₩552m is the PIPC’s total of three penalty surcharges (과징금) of ₩184m; the ₩16.2m is the total of the separate administrative fines (과태료), which we checked against each company’s amount. The budget carriers’ total is ₩60.9m in surcharges and ₩110.4m in administrative fines, from the PIPC’s release on that case. The PIPC does not name the intruder, and neither do we.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [Personal Information Protection Commission, 개인정보위, 안전조치 의무 위반한 삼양그룹 소속 4개사 제재 (four Samyang group companies sanctioned for breaching safeguard duties)](https://www.pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C020010000&nttId=12648) — 12 November 2026 In Korean; decisions of the 22nd plenary meeting, 11 November.
2. [Personal Information Protection Commission, 개인정보위, 8개 알뜰폰 사업자의 개인정보 처리에 대한 조사 결과 발표 (results of the investigation of eight budget mobile carriers)](https://www.pipc.go.kr/np/cop/bbs/selectBoardArticle.do?bbsId=BS074&mCode=C020010000&nttId=12647) — 12 November 2026 In Korean.

**Disclosure.** TechBag is a software reseller: it earns when companies buy through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

**Read this next:** [40 hacks at 37 Korean financial firms in five weeks; regulator to inspect 580](https://www.thetechbag.com/blog/korea-40-hacks-37-financial-firms) — South Korea’s financial regulator the same autumn: 40 hacks at 37 firms in five weeks, 473,000 records, and about 580 firms to be inspected.

Go deeper on TechBag

- [Vulnerability management guide](https://www.thetechbag.com/browse/security/vulnerability-management) — tools that find internet-facing servers a team has forgotten
- [Data security posture management guide](https://www.thetechbag.com/browse/data-security-privacy/dspm) — tools that find leftover copies of personal data
- [Encryption and rights management guide](https://www.thetechbag.com/browse/data-security-privacy/encryption-rights) — encrypting national ID numbers and other sensitive fields