Lee & Lee CC Personal Data Breach... Possible Involvement of North Korean Hackers

Investigation Launched After Data Leak Confirmed in October Last Year

It has been confirmed that personal information belonging to tens of thousands of customers was leaked from a golf course located in Gapyeong County, Gyeonggi Province.

According to police on April 26, the Security Investigation Bureau of the National Police Agency launched an investigation after confirming that in October of last year, malicious code inserted by a hacker into the homepage of Lee & Lee Country Club (Lee & Lee CC) resulted in a large-scale leak of personal data.

The leaked personal information includes nine items: name, date of birth, gender, user ID, password, mobile phone number, landline phone number, email, and address. For customers who registered on the Lee & Lee CC website after the login system was changed in February 2023, six items—excluding user ID, password, and landline phone number—were reportedly leaked. Lee & Lee CC has posted an apology notice on its website to inform users of the breach.

After confirming the leak, the golf course announced that it had taken measures in accordance with recommendations from the National Police Agency, including isolating and deleting files related to the malicious code, blocking the upload of abnormal file extensions, and preventing script execution in upload pathways.

The scale of the personal data breach is estimated to reach up to 100,000 individuals.

The police reportedly became aware of the leak during an investigation into major North Korean hacking organizations. Authorities believe that the golf course's server was infected with malicious code from a hacking group and are currently investigating. A police official stated, "We have confirmed the personal data leak and are conducting an investigation," but added, "We cannot disclose further details at this time."

This content was produced with the assistance of AI translation services.