"Boram Sangjo, which leaked 28,000 members' records, fined 550 million won", 14 May 2026

Boram Sangjo, which suffered a hacking incident in May 2024 that resulted in the leak of 27,882 items of personal information — including the names and mobile phone numbers of integrated website members and online consultation applicants — has been sanctioned with an administrative fine of 542.5 million won and a penalty of 11.4 million won, totalling approximately 554 million won.

In particular, it emerged that, in the course of managing personal data on a group-wide basis — whereby a single affiliate was designated to centrally manage the member records of six group companies — Boram Sangjo neglected its supervisory obligations, despite the fact that effective oversight of personal data processing and protection measures is the duty of the company that has entrusted the data.

…

In addition, it was confirmed that Boram Sangjo Development failed to notify data subjects without delay upon becoming aware of the personal data breach, instead notifying them after the statutory deadline had passed. It was also established that the company had retained personal data beyond its permitted retention period without destroying it.