A total of 5 unauthorized access incidents involving HALMEK up were confirmed between 13 June and 9 September. The final report found that a suspicious program had been installed and authentication credentials had been used without authorization. No evidence was found of files on the server being viewed or leaked externally, and no evidence of personal information being leaked was discovered.
A total of 5 unauthorized access incidents involving HALMEK up were confirmed between 13 June and 9 September, and it was discovered that a suspicious program had been installed on the site. The investigation was conducted by outside specialists. The final report found that the attacks had continued from before 9 September and confirmed unauthorized access at multiple points in time.
Compared with the initial report released on 11 September, the final report revealed that 5 unauthorized access incidents had occurred, 1 each on 13 June, 7 August, 2 September, 3 September and 9 September. This indicated differences in the understanding of the start date and scope of the breach.
On 10 September, the company identified that the ID and password of 1 employee had been used without authorization and changed the password required to access the administrative panel. The company explained that the systems department removed all suspicious programs between 9 and 12 September, and proceeded with a review of its future security framework.
The forensic investigation reported that, during the period in which the 5 unauthorized access incidents were confirmed, no evidence was found of files on the server being viewed, obtained or transferred externally, and no evidence indicating the external leakage of personal information was detected. Although the findings did not indicate a leak of personal information, they called for continued reporting to relevant external organizations.