2024 HD Hyundai — MDM server web-shell breach; 9,503 employee records (PIPC fine Aug 2026)
Data compromised
Names and employee numbers of HD Construction Equipment executives, staff, and partner-company employees (9,503 people per PIPC)
Technical writeup
Verified regulator enforcement — disclosed August 27, 2026. South Korea’s Personal Information Protection Commission (PIPC) fined HD Construction Equipment ₩73.5 million and HD Korea Shipbuilding & Offshore Engineering ₩4.8 million after finding inadequate security and access controls led to a March 2024 breach. Investigators said an unidentified attacker exploited a file-upload vulnerability on HD Korea Shipbuilding’s mobile device management server, uploaded a web shell, and reached an HD Construction Equipment internal business system linked to that server, exfiltrating personal information for 9,503 people including executive and employee names and employee numbers plus partner-company staff. PIPC cited missing upload protections and unnecessary cross-system linkage without IP or access restrictions. recordsAffected 9503 from regulator attestation; companyConfirmed true via PIPC action.
Root cause
Hacker exploited file-upload vulnerability on HD Korea Shipbuilding MDM server (March 2024), pivoted to HD Construction Equipment internal system lacking cross-system access controls