> series: anatomy_of_a_breach —— part: 062 —— target: 3_korean_credit_card_companies —— records: 20,000,000 —— method: usb_drive<span class="cursor-blink">_</span>_
In January 2014, South Korean prosecutors arrested a temporary IT consultant at the Korea Credit Bureau (KCB) — a credit scoring agency similar to the UK's Experian or Equifax — who had stolen the personal and financial data of approximately 20 million people from three major credit card companies: KB Kookmin Card, Lotte Card, and NH Nonghyup Card. The consultant, who had been hired to work on system upgrades, had simply copied the data to a USB drive over a period of months.
The stolen data included names, social security numbers (Korean resident registration numbers), phone numbers, addresses, credit card numbers, and credit scores. At 20 million records — representing approximately 40% of South Korea's 50-million population — it was one of the largest insider data thefts ever recorded. The breach triggered a national crisis: millions of South Koreans cancelled their credit cards, the CEOs of all three credit card companies offered their resignations, and the Korean government introduced emergency data protection legislation.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping CallThe Korea Credit Bureau breach was the fourth major insider data theft in this series, following T-Mobile UK (2009), Chelsea Manning (2010), and Vodafone Germany (2013). In every case, the pattern was identical: an authorised user with legitimate access used that access to extract bulk data to portable media without detection. And in every case, the controls that would have prevented or detected the theft — USB port restrictions, data loss prevention, behavioural monitoring, and access minimisation — were absent.
The Korea Credit Bureau breach was preventable with controls that are standard components of modern security programmes: USB port restrictions (allowing only approved encrypted devices), data loss prevention monitoring (detecting bulk data export), behavioural analytics (flagging anomalous database access patterns), least-privilege access (limiting consultant access to the minimum required), and audit logging (providing a forensic trail of all data access).
Cyber Essentials certification mandates removable media controls. Our penetration testing validates these controls and assesses insider threat scenarios. SOC in a Box provides the behavioural monitoring and data loss prevention that detects bulk data extraction. And UK Cyber Defence provides forensic investigation when insider theft is suspected.
<a href="/cyber-essentials">Cyber Essentials</a> mandates USB controls. <a href="https://www.socinabox.co.uk">SOC in a Box</a> monitors for bulk data extraction. Our <a href="/penetration-testing/infrastructure">penetration testing</a> tests insider threat scenarios.
We'll scope your test for free and tell you exactly what you need. No obligation, no hard sell.
Free Scoping Call