According to Seoul Economic Daily reporting as of Oct. 22, Yonsei University sent out a text message that day saying, "We have confirmed that the personal information of some members was leaked due to unauthorized external access to the Yonsei Portal Service."
According to Yonsei, the breaches occurred between 7:41 p.m. and 7:43 p.m. on Oct. 20 and between 4:04 a.m. and 4:11 a.m. on Oct. 21. The leaked data includes student and employee ID numbers, names, mobile phone numbers, email addresses and some system management information. The system management information includes login identification keys, the number of failed password attempts, user status codes and the date and time of last login.
Unique identifying information such as resident registration numbers and sensitive information were not included, the university said. However, because the items leaked vary by individual, additional leaked information could emerge during the investigation.
Yonsei also sent an email notice about the data breach at around 12:30 a.m. that day. "An unauthorized outside party accessed the Yonsei Portal Service and viewed the personal information of some members through abnormal means," the university said. "We have blocked the attacker's IP address and the leak route, and reported the incident to the Personal Information Protection Commission and other authorities."
Yonsei plans to conduct a security review of its systems overall while strengthening monitoring and security. Details, including the items leaked for each individual, were made available on the notices section of Yonsei's main website from 1 p.m. that day.
"We are blocking the leak route, reporting to relevant agencies, requesting an investigation and conducting additional security checks," the university said. "Please be cautious of text messages, phone calls and emails impersonating the university, and refrain from clicking links of unclear origin or entering personal information."