Supreme Court criticized for letting officials responsible for data leak off with slap on the wrist
After the personal data of nearly 18,000 people was exposed in a network breach, Korea's top court issued only a “stern warning” to those at fault, prompting criticism from lawmakers.
The Seoul Central District Court building in Seocho District, southern Seoul
YONHAP
The Supreme Court only gave “stern warnings” against its staff responsible for the data leak of 18,000 people on its network, leading to criticism over the highest court's lenient self-management of personal information.
Last year, the Supreme Court conducted an internal audit into the leak of personal information from the court computer network between June 2021 and January 2023, according to data submitted by the court to Rep. Lee Sung-yoon of the Democratic Party (DP), a member of the National Assembly’s Legislation and Judiciary Committee, on Friday.
The audit resulted in one departmental warning and stern warnings for five people. The court determined that disciplinary measures could not be taken against two others.
During investigations, police found that 1,014 gigabytes of data had been leaked. The compromised data included the personal information of 17,998 people, including names, resident registration numbers, dates of birth and contact information.
The Supreme Court had also been criticized over its initial response, when detected malware on its computer network in February 2023 but only launched an official investigation after media reports revealed the data breach in November that year.
Based on an audit against the National Court Administration, the court body responsible for the court's administrative work, held from March through October last year, the Supreme Court concluded that the incident “seems to have resulted from shortcomings in the information security management system across the judiciary,” and added that it would “strengthen technical and administrative measures, including systematically documenting the causes of the incident and the response process, to prevent a recurrence of security breaches.”
The court said it also implemented follow-up measures after an audit to strengthen personal information protection, including a project to establish a security operations system.
However, Rep. Lee criticized the Supreme Court for acknowledging problems with its information security management system while failing to take commensurate action against those involved.
“This was a serious incident in which sensitive information related to the public’s court cases was not properly protected, so there must be a thorough examination of who was responsible and whether the disciplinary measures were appropriate,” Lee said. “The Supreme Court must transparently disclose to the public the causes of the incident and the grounds for the measures taken against each person responsible.”
BY HAN YOUNG-HYE [yoon.soyeon@joongang.co.kr]
This article was originally written in Korean and translated by a bilingual reporter with the help of generative AI tools. It was then edited by a native English-speaking editor. All AI-assisted translations are reviewed and refined by our newsroom.
