Personal data of 400+ saemaul geumgo mutual-aid members leaked in cyberattack

The personal data of more than 400 mutual-aid members of the Saemaul Geumgo Central Association was leaked in a cyberattack. The association said it discovered the breach Monday and reported it to the Korea Internet & Security Agency (KISA) on Tuesday.

According to the association, the attack took place Saturday. The leaked information varies by customer but spans up to 12 categories: customer number, name, encrypted resident registration number, account number, date of birth, mobile phone number, home phone number, office phone number, home address, office address, email address and account balance.

The association posted a notice on its website titled "Notice on personal (credit) information leak and related matters," informing affected customers of the breach and the steps taken in response.

In the notice, the association said it had blocked the IP addresses used by the hacker — including proxy access IPs — and had inspected and patched vulnerabilities on its website. Customers whose data was confirmed to have been leaked will be notified individually by text message, and the association said it would also allow customers to check online whether their information was affected and which categories were involved. The association added that it would provide full compensation for any damages resulting from the incident.

The breach involves mutual-aid members managed by the central association, not individual saemaul geumgo branches. "The mutual-aid system is managed at the central association level, so we believe the likelihood of damage spreading to individual branches nationwide is low," an association official said.

The exact method of intrusion and the identity of the attacker have not yet been determined. "It has not been confirmed whether this is the same attack as the series of hacking incidents that recently hit the financial sector," an official said, adding that the association was continuing to investigate the specific intrusion route. The official said the association also suspects the attack may have used AI but that further verification is needed.