KEPCO Employee Data Exposed Online: South Korea's Utility Faces Cyber Questions

The personal information of approximately 24,000 employees at Korea Electric Power Corporation (KEPCO), South Korea state-run utility, was publicly exposed on an external website, sparking immediate concern. The breach, which KEPCO discovered on October 1st, included names, departments, phone numbers, and email addresses, though the company confirms highly sensitive data like resident registration numbers and customer information remain secure. While the exposed data was removed after about 32 hours, the incident highlights a worrying trend in data security. This KEPCO incident comes amidst a troubling wave of cybersecurity incident in South Korea, particularly affecting the financial sector with recent AI-driven hacking attempts. While KEPCO has cautiously stated that, so far, no signs of hacking have been identified and the exposure might be due to a mistake by an outsourced data management provider, the sheer volume of exposed employee data from a critical state-run entity raises questions about broader national cybersecurity defenses. The company's delay in removing the data, even after detection, further amplifies these concerns for both employees and national infrastructure security. KEPCO has since established an emergency response center and is conducting a joint investigation with relevant authorities to pinpoint the exact cause and prevent future occurrences. Affected employees have been notified and advised to be vigilant against potential secondary damages like phishing attempts. The ongoing probe will determine whether this was a targeted cyberattack or an internal oversight, with its findings likely influencing future cybersecurity protocols for major public corporations in South Korea and possibly leading to remedial actions, including compensation for affected individuals.