Personal information on some employees of NICE D&B, a corporate credit information firm under South Korea's NICE Group, was publicly accessible outside the company for about 10 years, according to findings confirmed by the company. NICE D&B became aware of the exposure only during a recent security review and has since taken steps to close it off.
NICE D&B recently posted a notice on its website disclosing that personal information on some employees had been publicly available in an external source code repository, financial industry sources said on the 15th.
The data was posted around 2016 on GitHub, an external source code repository, in the course of a project. Such repositories are online spaces where developers store and share source code and revision histories. The information remained publicly viewable there for roughly 10 years. The exposed data included employees' names, mobile phone numbers, office extension numbers, and both company and personal email addresses. Information on 10 employees was exposed, according to sources.
NICE D&B discovered the exposure during a recent security review of external platforms. The company tried to contact the person who had created the repository but was unable to reach them, and instead asked the platform operator to delete the material directly. External access to the data was blocked on the 7th of this month. The company also notified the affected employees.
NICE D&B said no cases of harm stemming from the exposure have been identified so far. Still, because personal contact details were included, the company urged particular caution against spam text messages from unknown senders and voice phishing.
NICE D&B is a credit information specialist that assigns corporate credit ratings and provides credit risk management solutions to financial institutions. It also holds Information Security Management System (ISMS) certification. The company spent about 1.7 billion won ($1.2 million) on information protection last year, equal to 65% of its total information technology investment. It has also disclosed that it carries out information security measures and inspections every month.
Industry officials are focusing on a recent string of personal data breaches caused by external hacking, centered on banks and non-bank financial firms. With a long-running data exposure now confirmed at a credit information specialist, some argue that the scope of security reviews and the broader management framework need to be strengthened.
"At a time when awareness has been heightened by external hacking incidents, the fact that personal information was left exposed suggests the review system was inadequate," an official in the financial industry said. "There may be limits to checking every repository, but companies need to broaden the scope of their reviews and act on it."