"Operator's Carelessness"... Personal Information Leak from LG Uplus AI Assistant 'IXIO' (Update)

Contact Information and Call Summaries Exposed
Issue Detected at 10 a.m. on December 3... Reported to Personal Information Protection Commission

Personal information of 36 customers was leaked from LG Uplus's artificial intelligence (AI) call assistant service, 'IXIO'.

On December 6, LG Uplus announced that during recent operational improvement work on the IXIO service, a cache configuration error led to the exposure of personal information belonging to 36 customers. The exposed information included the phone numbers of call recipients, call times, and call summaries, which were temporarily visible to 101 other users.

The exposure occurred between 8:00 p.m. on December 2 and 10:59 a.m. on December 3. During this period, the information was exposed to 101 users who installed or reinstalled IXIO. For each affected customer, their information was exposed to between one and six other users.

An LG Uplus representative stated, "The leaked information did not include unique identifiers such as resident registration numbers or passport numbers, nor did it include financial information."

LG Uplus explained that as soon as the issue was identified at 10:00 a.m. on December 3, the company immediately began investigating the cause and carried out recovery measures, ensuring that the exposed call information was no longer visible.

All affected customers were notified by phone, and those who could not be reached were informed via text message. The company also reported the IXIO call information leak to the Personal Information Protection Commission on its own initiative.

Launched just over a year ago, IXIO is an AI call service developed in-house by LG Uplus. It is known for providing features such as visible calls, real-time voice phishing detection, and call recording and summarization, all in an on-device environment. The company has promoted the security advantages of its on-device technology, which processes voice data directly on the device without passing through a server.