The Personal Information Protection Commission announced on June 11 that it has launched an investigation after receiving a report of a personal data breach from the online bookstore Yes24.
According to the commission, Yes24 reported earlier that morning that it had detected signs of abnormal access to member information during its response to a ransomware attack, which it became aware of on June 9.
Ransomware is a type of hacking method in which computer systems or data are encrypted and a ransom is demanded.
Currently, all services of Yes24, including book searches, orders, and ticket reservations, have been suspended.
Previously, Yes24 posted a notice on its website and application stating, "The current access error has occurred due to a ransomware-related disruption starting around 4 a.m. on Monday, June 9, and recovery efforts are underway," adding, "Internal investigations have not confirmed any evidence of a personal data breach."
The commission plans to determine the specific circumstances and scale of the breach, as well as whether Yes24 complied with its obligations for safety measures, and will take action in accordance with the Personal Information Protection Act.
In addition, it was reported that the commission will verify the legality of the breach notification procedures.
Under relevant laws, all personal information controllers are required to report a data breach to the commission within 72 hours of becoming aware of the incident.
An official from the commission stated, "To determine whether the breach notification was legally compliant, it is necessary to confirm the exact time the breach was recognized, and we plan to identify when this occurred during the investigation process."
© The Asia Business Daily(www.asiae.co.kr). All rights reserved.
