INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

NHIS Employee Sold Data to Victims for Three Months

| 2026-10-16 13:02 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
A National Health Insurance Service (NHIS) employee was dismissed for illegally selling personal information of health insurance subscribers to external parties, but victims have yet to be notified of the data breach that occurred in October 16. The employee provided personal data of subscribers and dependents to external entities illegally for over two years in exchange for bribes from Rep. Kim Ki-woong of the People Power Party and NHIS Executive Managing Director Jeong Jae-wook, who received "an amount in the hundreds of millions of won". This incident falls under the targeted sectors of Health and Government, with a cyber operation type of Data Breach. The breach was discovered by Rep. Kim Ki-woong during a parliamentary audit of the Health and Welfare Committee. Under the Personal Information Protection Act, data handlers must notify affected parties within 72 hours of discovery, but NHIS has not informed victims for three months since July.
Technical Mitigations AI-generated
• Patch the NHIS system to address vulnerabilities that could be exploited by insiders, using a version with known security patches. • Implement regular audits and monitoring of employee activities to detect insider threats in real-time. • Conduct thorough background checks on employees handling sensitive data before hiring them.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope governmentgovernment healthhealth
Incident Timeline
‎October 16
Rep. Kim Ki-woong of the People Power Party revealed during a parliamentary audit on October 16 that an NHIS employee had sold data, but it was not disclosed to victims for three months prior.
organisation the People Power Party
Rep. Kim Ki-woong of the People Power Party revealed this during a parliamentary audit of the Health and Welfare Committee on October 16.
organisation the Health and Welfare Committee
Rep. Kim Ki-woong of the People Power Party revealed this during a parliamentary audit of the Health and Welfare Committee on October 16.
‎2026/10/16
A NHIS employee was dismissed for selling personal health insurance data to external parties, but the organization failed to notify affected subscribers of the breach within 72 hours as required by law.
organisation Sold Data
KR: NHIS Employee Sold Data, Victims Uninformed for Three Months.
organisation NHIS Executive
NHIS Executive Managing Director Jeong Jae-wook responded that the employee received “an amount in the hundreds of millions of won” in exchange for the data.
organisation NHIS
The NHIS dismissed the employee in July but has not informed victims of the breach for three months since.
organisation the Personal Information Protection Act
Under the Personal Information Protection Act, data handlers must notify affected parties of the breach’s details and preventive measures within 72 hours of discovery.
Intelligence Sources
Data Breaches 2026-10-16