Stealing Millions of Internet User Accounts for Profit... Committing Crimes Even During Trial

Chuncheon District Court Sentences 20-Year-Old to 1 Year and 6 Months in Prison
Hacked Site and Sold 6.4 Million Personal Information Records

A man in his 20s who hacked and sold about 6.4 million internet site member records while on trial for insurance fraud was sentenced to prison.

On the 23rd, Yonhap News reported that the Chuncheon District Court Criminal Division 3 (Presiding Judge Park Seong-min) sentenced Mr. A (24), who was indicted for violating the Personal Information Protection Act and the Information and Communications Network Act, to 1 year and 6 months in prison. Mr. A was prosecuted for hacking multiple internet sites from December last year to May this year and selling about 6.4 million pieces of personal information, including member contact details, to an unknown person for about 57 million won.

A hacker is attempting to hack during the cyber firewall pilot construction demonstration. Photo by Moon Honam

Additionally, from January to May, Mr. A hacked 25 sites, including lottery information provision sites, obtaining about 1.47 million pieces of personal information. The indictment also included an attempted but failed crime on 55 other sites using the same method. Investigations revealed that Mr. A committed these crimes using hacking methods he learned through academy classes. After selling the personal information obtained through hacking, he intended to share the profits with acquaintances. At the time Mr. A was hacking and stealing personal information, he was also undergoing another trial at the Daejeon District Court Hongseong Branch for violating the Insurance Fraud Prevention Act.

The court pointed out, "The defendant’s crimes caused numerous victims and social costs, and resulted in consequences that could be exploited as means for other crimes, thus requiring strict punishment." Regarding the sentencing, the court explained, "The sentence was determined considering the many offenses committed over a considerable period and the significant profits gained from the crimes."

Meanwhile, as personal information leakage incidents increase every year, about half of these incidents are identified as caused by 'hacking.'

On the 20th, the Personal Information Protection Commission announced this at the 'Personal Information Policy Forum' held at the Bankers Hall in Jung-gu, Seoul. The commission reported that the number of personal information leakage reports steadily increased from 47 cases between August and December 2020 to ▲163 cases in 2021 ▲167 cases in 2022 ▲318 cases in 2023. Among these, leaks from public institutions rose from 5 cases in 2020 to 41 cases in 2023, while private companies increased from 42 cases to 277 cases during the same period.

From January to August this year, a total of 208 personal information leakage incidents were reported. Of these, 74 cases (35.6%) occurred in public institutions, and 'hacking attacks' accounted for 48%, nearly half. Following that were ▲work errors by personal information handlers (37%) ▲personal information processing system errors (12%).