Seven items of information—including the names, departments, employee ID numbers, mobile phone numbers, office phone numbers, email addresses and positions of more than 24,000 Korea Electric Power Corporation (한국전력공사, KEPCO) employees—were exposed on an external website. KEPCO became aware of the exposure at about 3:59 p.m. on October 1. News reports said the information was removed from the website around midnight at the start of October 3, about 32 hours after KEPCO became aware of it. The cause of the exposure and whether any actual secondary harm occurred have not yet been confirmed.

Background and context

The exposed information did not include unique identifying information such as resident registration numbers or sensitive information. Instead, it included information linked to employees’ identities, departments and work-related contact details. KEPCO said customer information managed in a separate, dedicated system was also not exposed. These facts are important for gauging the scope of the exposure, but they do not diminish the incident itself: employee information was made public externally.

KEPCO said that after becoming aware of the exposure, it blocked access to internal systems related to employee personal information and asked the operator of the external website to remove the information. However, it took about 32 hours for the information to be removed.

At about 1:22 p.m. on October 4, KEPCO reported the incident to the Personal Information Protection Commission (개인정보보호위원회) and established an emergency response control center. It said it was investigating the precise circumstances with relevant agencies, but the information currently available does not show how the data ended up on the external website. KEPCO said it separately notified employees about the incident and its circumstances by text message, email and other means, and provided guidance on preventing secondary harm.

What this news means

The people directly affected by the incident are effectively all KEPCO employees—more than 24,000 people. KEPCO’s statement that resident registration numbers and customer information were not exposed is a factor to consider in understanding the scope of the harm. However, because names, departments, employee ID numbers, phone numbers and email addresses were exposed together, they could be used to identify and contact specific employees. Those affected should therefore be alert to unexpected contact or impersonation attempts. This is an interpretation of possible risks, not a statement that such harm actually occurred.

For example, if a KEPCO employee receives a message that appears to relate to internal work and is asked to provide additional information or verify details, they may want to be alert to the possibility that it is an impersonation attempt connected to the exposure. However, there is no confirmation that phishing or impersonation harm actually resulted from this incident. KEPCO said it individually provided guidance on preventing harm, so employees who received the notice should review it and, if they receive suspicious contact, avoid responding hastily or providing information.

The response to the incident should be assessed not only by whether the information was removed, but also by whether the circumstances of the exposure are established, whether actual harm is confirmed, and whether remedies are provided if harm has occurred. KEPCO said it would determine the cause through a joint investigation with relevant agencies and its own investigation, and develop measures to prevent a recurrence. It also said that if reports are received that harm has occurred or is anticipated, it plans to conduct the necessary investigations and pursue remedies, including compensation for damages. This does not mean that a remedy has already been guaranteed; it is a plan to proceed after receiving reports and conducting an investigation.

Related systems and support information

KEPCO said that if reports are received that harm has occurred or is anticipated, it plans to conduct the necessary investigations and pursue remedies, including compensation for damages. However, the exposure of personal information alone does not automatically determine whether compensation is owed or its amount. According to materials based on counseling cases from the Korea Legal Aid Corporation (대한법률구조공단), compensation is calculated by considering the type of harm and the circumstances in which it occurred, the victim’s contributory fault, the terms of any settlement, and whether insurance benefits or wages were received, among other factors. These materials explain general principles of compensation for damages; they do not establish any individual’s liability or the amount of compensation in this incident.

Employees who believe they have actually suffered harm can therefore keep the exposure notice, related communications and records showing the harm they experienced, and ask KEPCO what reporting procedures and supporting materials are required. Anyone considering a settlement should also review its scope. The materials explain that, in general, a settlement may limit subsequent claims, but an additional claim may be possible for significant subsequent harm that could not reasonably have been anticipated at the time of the settlement. The specific application of these principles and any limitation period may depend on the nature of the harm and when it became known, so no single conclusion can be applied across the board.

Differences in how reports described the timing

Reports differ in how they described when the information was removed. One report said it was removed around midnight at the start of October 3, while another English-language report said removal was completed around midnight on Friday. Based on the information provided, it is difficult to tell whether the two accounts describe the same time differently or whether the timing actually differed. The estimate of about 32 hours appears in Korean-language reporting.

What is confirmed and what remains unknown

Confirmed facts

  • KEPCO became aware at about 3:59 p.m. on October 1 that employee personal information had been exposed on an external website.
  • The seven exposed items were names, departments, employee ID numbers, mobile phone numbers, office phone numbers, email addresses and positions; more than 24,000 people were affected.
  • KEPCO said that unique identifying information and sensitive information, as well as customer information held in a separate, dedicated system, were not exposed.
  • KEPCO blocked access to its internal systems and requested removal of the information. On October 4, it reported the incident to the Personal Information Protection Commission and established an emergency response control center.
  • KEPCO said it individually notified employees and plans to pursue remedies after an investigation if reports of harm are filed.

What remains unknown

  • What were the specific circumstances and cause of the employee information being exposed on the external website?
  • Did the exposure lead to any actual secondary harm?
  • If harm occurred, what type and scale was it, and how will the investigation and remedies proceed?

What readers should check

  • KEPCO employees can review the individual notice and guidance on preventing secondary harm sent by text message or email, and take care not to provide personal or additional information in response to suspicious contact.
  • If actual harm has occurred or is anticipated, employees can keep records of related communications and evidence of the harm, then ask KEPCO about the reporting process and required materials. It cannot be assumed that the notice specified a particular reporting method.
  • Anyone considering compensation or a settlement can review records of the harm and the terms of the settlement, and seek legal advice on issues that require case-by-case assessment.

References