HD Construction Equipment was fined 73.5 million won, while HD Korea Shipbuilding & Offshore Engineering received an administrative penalty of 4.8 million won for violating personal information protection regulations. The Personal Information Protection Commission announced the decisions on August 27 after approving them at its 17th plenary meeting on August 26. Its investigation found that an unidentified hacker uploaded a web shell file around March 2024 by exploiting a vulnerability in a mobile device management server operated by HD Korea Shipbuilding & Offshore Engineering. Because the server could communicate with HD Construction Equipment’s internal business systems despite having no operational need to do so, the attacker reached personal information processing systems and stole the names and employee ID numbers of 9,503 employees and partner company staff. The commission cited inadequate safeguards against file-upload vulnerabilities and weak access controls, and urged regular security inspections and restrictions on access rights, including IP-based controls.