Douzone Bizon Reports Two Breaches in October; Government Calls It 'Serious' and Opens a Joint Probe

Two doors were open

On Oct. 15 an unidentified outsider got into an internal system through an employee's VPN account and viewed data, the company says. It reported this to the government on Oct. 16 and posted a notice on Oct. 18.

A second report followed on Oct. 21. This time signs showed that some encrypted data on a server of its 'APO backup service' had been taken out, and the company announced it on Oct. 23.

A backup-software flaw may be the cause

Douzone said the backup-software vendor Ahsay told it that a vulnerability in the backup server may have been exploited. The company reads it as a possible zero-day attack, which is its own account and one the joint team has yet to verify.

What may have got out

The company's concern is employee information of client companies. The notice for the first incident lists name, the last six digits of the resident registration number (encrypted), account number (encrypted), address, mobile number and email as possibly affected.

What actually left, and how much, has not been pinned down, and the number of affected clients or people has not been published.

Why the government says 'serious'

The ministry convened an emergency review committee on Oct. 25 and judged the case serious because harm could spread to client companies. The team is led by the ministry's director for information-security network policy, joined by KISA and private experts, and the findings are to be made public.

Douzone says it has blocked the VPN account and function and the overseas IPs, and shut down the affected servers.

If your employer uses Douzone

The company warns of texts and calls that impersonate Douzone or public agencies and ask for personal or financial details. It says it never asks for passwords, verification codes or account numbers by text or phone. Until the findings are out, check its official notices first.