South Korea fines HD Construction Equipment ₩73.5 mn over 9,500-worker data breach
Synopsis
South Korea's privacy regulator has fined HD Construction Equipment 73.5 million won after a hacker breached an affiliate's server in March 2024 and stole data on 9,503 workers — exposing a critical gap in inter-system access controls. The action arrives alongside a far larger 53.9 billion won penalty against KT Corp., signalling that Seoul's PIPC is moving from warnings to enforcement at scale.
Key Takeaways
HD Construction Equipment fined 73.5 million won ($53,200) by South Korea's Personal Information Protection Commission on 27 August .
An unidentified hacker breached affiliate HD Korea Shipbuilding and Offshore Engineering's server in March 2024 , stealing data on 9,503 workers .
Stolen data included employee names and identification numbers ; the affiliate was separately fined 4.8 million won .
Regulator found both companies failed to restrict inter-system access even when not operationally required.
Separately, KT Corp. was fined 53.9 billion won over a breach affecting 16,647 users and causing 240 million won in losses to 368 victims .
South Korea's Personal Information Protection Commission (PIPC) has fined machinery firm HD Construction Equipment 73.5 million won (approximately $53,200) after a cyberattack exposed the personal data of 9,503 workers, the regulator announced on Thursday, 27 August. The breach, traced to an unidentified hacker, is among the latest in a series of corporate data security failures now drawing regulatory action in South Korea.
How the Breach Occurred
According to the regulator's investigation, an unidentified hacker infiltrated the mobile equipment management server of HD Korea Shipbuilding and Offshore Engineering — an affiliate of HD Construction Equipment — in March 2024. The affiliate's system served as the access point, allowing the attacker to pivot laterally into HD Construction Equipment's network without restriction.
The stolen data included the names and employee identification numbers of 9,503 workers, covering both direct employees and contractor personnel. The regulator found that the two companies had failed to restrict inter-system access even in cases where such access was operationally unnecessary — a fundamental lapse in network segmentation.
Fines and Regulatory Action
The PIPC imposed a fine of 73.5 million won on HD Construction Equipment as the primary data controller. Its affiliate, HD Korea Shipbuilding and Offshore Engineering, was separately fined 4.8 million won for its role as the entry point of the breach. The combined penalty reflects the regulator's position that both entities bear accountability for the security failure.
The Broader Pattern: KT Corp Fined ₩53.9 Billion
The HD Construction Equipment action comes alongside a far larger penalty handed down in late July against wireless carrier KT Corp., which was fined 53.9 billion won (approximately $37.4 million) over a separate and significantly more severe breach. In that case, hackers accessed KT's wireless network using authentication certificates extracted from base stations the company had lost, operating undetected between 8 October 2024 and 5 September 2025.
The KT Corp. breach affected the phone numbers and mobile device identification numbers of 16,647 users. Malicious actors used the stolen data to carry out unauthorised transactions, resulting in total losses of 240 million won across 368 victims. Notably, the company only became aware of the breach after receiving a user complaint — not through its own monitoring systems. The PIPC has also ordered KT to implement corrective measures.
What This Signals for Corporate Data Security
The twin enforcement actions underscore the PIPC's increasingly assertive posture on corporate data protection. Both cases share a common thread: companies failed to implement basic access controls and breach-detection mechanisms, allowing attackers to operate unimpeded for extended periods. Critics argue that financial penalties alone may be insufficient deterrents for large conglomerates, and that mandatory security audits should accompany fines.
As South Korea tightens enforcement of its personal data protection framework, companies with interconnected affiliate networks face heightened scrutiny over how access privileges are managed across entities. Further regulatory guidance on inter-system access controls is expected in the coming months.
Point of View
503 workers' data compromised for a fine equivalent to roughly $53,000. The real signal is the regulatory pattern: two major enforcement actions in quick succession suggest the PIPC is building a deterrence record, not just issuing warnings. The KT Corp. case is more alarming — hackers operated inside a live wireless network for nearly a year before a customer complaint triggered discovery, which raises serious questions about the adequacy of internal monitoring at one of Korea's largest carriers. For companies with complex affiliate structures, the HD case is a direct warning: shared network access without access controls is now a compliance liability, not just an IT oversight.
NationPress
27 Aug 2026
Frequently Asked Questions
Why was HD Construction Equipment fined by South Korea's regulator?
HD Construction Equipment was fined 73.5 million won because an unidentified hacker exploited its affiliate's server in March 2024 to steal the personal data of 9,503 workers. The regulator found the two companies had failed to restrict access between their systems even when such access was unnecessary.
What data was stolen in the HD Construction Equipment breach?
The hacker stole the names and employee identification numbers of 9,503 workers, including both direct employees and contractor personnel of HD Construction Equipment.
What role did HD Korea Shipbuilding and Offshore Engineering play in the breach?
HD Korea Shipbuilding and Offshore Engineering's mobile equipment management server was the initial point of compromise. The hacker used it as a gateway to access HD Construction Equipment's systems, and the affiliate was separately fined 4.8 million won for this lapse.
What is the KT Corp. data breach case about?
South Korea's PIPC fined wireless carrier KT Corp. 53.9 billion won after hackers accessed its wireless network using authentication certificates from lost base stations, exposing data of 16,647 users between October 2024 and September 2025. The breach caused 240 million won in losses for 368 victims, and KT only discovered it after a user complaint.
What does South Korea's PIPC require companies to do after such breaches?
Beyond financial penalties, the PIPC ordered KT Corp. to implement corrective measures following the breach. In the HD Construction Equipment case, the regulator's findings indicate that restricting unnecessary inter-system access is a baseline compliance requirement under South Korea's personal data protection framework.
