INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

CI·DI Exposes Leaked Resident Numbers

| 2026-10-05 00:29 HIGH LOW DATA BREACH
JSON
Executive Summary
AI-generated
Over six years, more than 5,050,000 resident registration numbers have been leaked in South Korea. The leak is attributed to the Children's Rights Protection Organization and other institutions with significant data breaches. A total of over 2,780,000 cases of linked information (CI) and duplicate verification information (DI) were exposed, including instances of Yalol DI, Tour Network CI and DI, and Lotte Card CI. The leak is believed to have occurred between 2021 and September 2026, with a total of 130 confirmed cases of resident registration numbers leaked during this period. However, the exact scale of the leak cannot be determined due to missing log records or deleted data in some cases.
Technical Mitigations AI-generated
• Patch the Yalol (DI) vulnerability to prevent duplicate registration status leaks. • Implement a secure data link between services using Tour Network's CI and DI, ensuring that leaked information is not combined with other personal info. • Block or hunt for instances of both Tour Network (CI and DI), as well as Lotte Card (CI). • Use encryption to protect resident registration numbers from being accessed by unauthorized parties.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope
Incident Timeline
‎September 2026
Threat actors leaked over six years' worth of resident registration numbers from multiple institutions, including Busan International Finance and Securities Institute, Children's Rights Protection Organization, Duo Information, Lotte Card, and LG U+, with some data encrypted.
organisation Busan International Finance
Three cases related to U Rica card and Busan International Finance and Securities Institute (BIFSI) incident are unable to accurately determine the scale of the leak due to the lack of log records or deleted data, and differences in the type of leaked information for different subjects.
organisation Securities Institute
Three cases related to U Rica card and Busan International Finance and Securities Institute (BIFSI) incident are unable to accurately determine the scale of the leak due to the lack of log records or deleted data, and differences in the type of leaked information for different subjects.
organisation the Children's Rights Protection Organization
The institutions and companies with the most leaked resident registration numbers were the Children's Rights Protection Organization, with 1,160,0001042 cases, followed by: *
organisation Duo Information
The resident registration numbers leaked by Duo Information and LG U+ were encrypted.
organisation Lotte Card
The scale of the leak has been confirmed in the following cases: 1,000,0002898 instances of Yalol (DI), 940,0008393 instances of both Tour Network (CI and DI), and 830,0006382 instances of Lotte Card (CI).
‎between 2021 and September 2026
Between 2021 and September 2026, the Ministry of Interior and Safety's documents and public meeting minutes revealed a total of 130 cases where resident registration numbers were leaked.
organisation the Ministry of Interior and Safety
An analysis of documents submitted by the Ministry of Interior and Safety and the Financial Supervisory Commission, as well as public meeting minutes, found that between 2021 and September 2026, a total of 130 cases of resident registration numbers were leaked.
general_metric 130 cases
An analysis of documents submitted by the Ministry of Interior and Safety and the Financial Supervisory Commission, as well as public meeting minutes, found that between 2021 and September 2026, a total of 130 cases of resident registration numbers were leaked.
‎2026/10/05
Threat actors leaked over six years' worth of resident registration numbers, including linked information and duplicate verification data.
organisation the Personal Information Protection Committee
Recent data from the Personal Information Protection Committee and the Financial Supervisory Commission revealed that more than 5,050,000 cases of resident registration numbers were leaked in the past six years.
organisation the Financial Supervisory Commission
Recent data from the Personal Information Protection Committee and the Financial Supervisory Commission revealed that more than 5,050,000 cases of resident registration numbers were leaked in the past six years.
organisation CI
The scope of the leak also included the linked information (CI) and duplicate verification information (DI) of online resident registration numbers, with a total of over 2,780,000 cases.
organisation DI
The scope of the leak also included the linked information (CI) and duplicate verification information (DI) of online resident registration numbers, with a total of over 2,780,000 cases.
Intelligence Sources
Chosun Economy 2026-10-05