INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Daegyo-Yeonghun Medical Foundation Hacked, Leaking Personal Info of Eight Hundred Forty Thousand

| 2026-10-29 16:10 CRITICAL LOW DATA BREACH
JSON
Executive Summary
AI-generated
A data breach incident occurred on October 29, 2026, at a hospital operated by Yung-hoon Medical Foundation in Daejeon and Yongsan, South Korea. The Daegyo-Yeonghun Medical Foundation was hacked, resulting in the leak of personal information of approximately eight hundred forty thousand individuals. An unknown hacker exploited a web vulnerability on the hospital's website to upload a web shell, which was then used to execute malicious code on two occasions in August 2024 and February 2025. The attack allowed access to an online education service 'Macadamia' connected to the affiliated web server, leading to the leak of personal data including names, birthdays, phone numbers, and linked information. As a result, the Personal Information Protection and Utilization Authority imposed a fine of three billion eight hundred eighty-five million won on the perpetrators, while also ordering Daegu Line Hospital and Yoon-hoon Medical Foundation to strengthen safety measures for their personal information processing systems.
Technical Mitigations AI-generated
• Reset credentials and API keys that may have been exposed, and review access logs for the affected accounts or integrations.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
KR
healthhealth
Incident Timeline
‎March 2024
Threat actors exploited a SQL injection vulnerability on the Daegyo-Yeonghun Medical Foundation's website in March 2024 to leak personal information of approximately eight hundred forty thousand individuals.
data_breach 188,481 website members
The hacker exploited the SQL injection vulnerability on the hospital website, which existed in March 2024, to leak personal information of 188,481 website members, including their IDs, passwords, names, phone numbers, and birthdays.
organisation The Korea Privacy Commission
The Korea Privacy Commission (KPCO) has ordered a 630,000,000 won fine to be paid to the Yoon Hoon Medical Research Institute, and has ordered the KPCO to implement regular checks and improvements to the personal information processing system.
organisation KPCO
The Korea Privacy Commission (KPCO) has ordered a 630,000,000 won fine to be paid to the Yoon Hoon Medical Research Institute, and has ordered the KPCO to implement regular checks and improvements to the personal information processing system.
organisation the Yoon Hoon Medical Research Institute
The Korea Privacy Commission (KPCO) has ordered a 630,000,000 won fine to be paid to the Yoon Hoon Medical Research Institute, and has ordered the KPCO to implement regular checks and improvements to the personal information processing system.
The Yoon Hoon Medical Research Institute was found to have been responsible for the large-scale personal information leak due to the lack of basic web security management and the habitual membership registration function on the hospital website.
organisation Daejoon
In the case of Daejoon, it was found that unnecessary access routes between the related server and member DB were exploited by the attackers, and the lack of response to the first security alert repeated the leak.
‎August 2024
An unknown hacker exploited a web vulnerability on Daegu Line Hospital's website to upload and execute malicious code, resulting in the leak of personal information.
organisation Daegu Line Hospital's
According to the commission's investigation, an unknown hacker exploited a web vulnerability on Daegu Line Hospital's website to upload a web shell, which was then used to execute malicious code on two occasions in August 2024 and February 2025.
‎February 2025
An unknown hacker exploited a web vulnerability on Daegu Line Hospital's website to upload a web shell, which was then used to execute malicious code in August 2024 and February 2025.
organisation Daegu Line Hospital's
According to the commission's investigation, an unknown hacker exploited a web vulnerability on Daegu Line Hospital's website to upload a web shell, which was then used to execute malicious code on two occasions in August 2024 and February 2025.
organisation Yung-hoon
A hospital operated by Yung-hoon Medical Foundation in Daejeon and Yongsan has suffered a data breach incident due to a vulnerability in its hospital website.
organisation Daegu
The Personal Information Protection Commission confirmed that Daegu's personal information protection officer (CPO) did not properly check the implementation of the internal management plan related to access control and prevention of personal information leaks.
organisation CPO
The Personal Information Protection Commission confirmed that Daegu's personal information protection officer (CPO) did not properly check the implementation of the internal management plan related to access control and prevention of personal information leaks.
organisation The Yoon Hoon Medical Foundation
The Yoon Hoon Medical Foundation was fined 188,481 people for SQL injection attacks.
organisation SQL
The Yoon Hoon Medical Foundation was fined 188,481 people for SQL injection attacks.
‎October 28
The Personal Information Protection Commission imposed fines of 3.255 billion won on Daegu Line Hospital and 630 million won on the Yoon-hoon Medical Foundation for violating safety measures under the Personal Information Protection Act on October 28.
organisation The Personal Information Protection Commission
The Personal Information Protection Commission, led by Chairperson Song Kyung-hee, decided in its 21st general meeting on October 28 to impose fines of 3.255 billion won on Daegu Line Hospital and 630 million won on Yoon-hoon Medical Foundation for violating safety measures under the Personal Information Protection Act.
organisation the Personal Information Protection Act
The Personal Information Protection Commission, led by Chairperson Song Kyung-hee, decided in its 21st general meeting on October 28 to impose fines of 3.255 billion won on Daegu Line Hospital and 630 million won on Yoon-hoon Medical Foundation for violating safety measures under the Personal Information Protection Act.
general_metric 630 Hospital
The Personal Information Protection Commission, led by Chairperson Song Kyung-hee, decided in its 21st general meeting on October 28 to impose fines of 3.255 billion won on Daegu Line Hospital and 630 million won on Yoon-hoon Medical Foundation for violating safety measures under the Personal Information Protection Act.
‎2026/10/29
Threat actors successfully hacked the Daegyo-Yeonghun Medical Foundation, resulting in the leak of personal information of approximately eight hundred forty thousand individuals.
organisation Daegyo-Yeonghun Medical Foundation
The Daegyo-Yeonghun Medical Foundation has been hacked, resulting in the leak of personal information of approximately eight hundred forty thousand individuals.
organisation Medical Foundation
A major South Korean healthcare company, Yoon-hoon Medical Foundation, which operates Daegu Line Hospital and Yungseon Hospital, has been fined approximately 3.885 billion won for leaking the personal information of 840,000 individuals due to hacking and violating safety measures.
organisation Daegu Line Hospital
A major South Korean healthcare company, Yoon-hoon Medical Foundation, which operates Daegu Line Hospital and Yungseon Hospital, has been fined approximately 3.885 billion won for leaking the personal information of 840,000 individuals due to hacking and violating safety measures.
organisation Yungseon Hospital
A major South Korean healthcare company, Yoon-hoon Medical Foundation, which operates Daegu Line Hospital and Yungseon Hospital, has been fined approximately 3.885 billion won for leaking the personal information of 840,000 individuals due to hacking and violating safety measures.
Tactical Metrics
Metrics
data_breach
188,481
Website Members
The hacker exploited the SQL injection vulnerability on the hospital website, which existed in March 2024, to leak personal information of 188,481 website members, including their IDs, passwords, names, phone numbers, and birthdays.
Intelligence Sources
Dailysecu 2026-10-29