Insiders are driving force behind data leak casesIllegal brokers who purchase personal data from employees at financial companies and sell them to loan service providers have been identified as the driving force behind the theft of personal information, according to authorities.
The revelation comes in the wake of the country’s worst breach of private information from credit card companies, which compromised approximately 104 million accounts.
In the latest case - in which the personal information of account holders from KB Kookmin, Lotte and NH cards was jeopardized - a 39-year-old technician, identified only by his surname Park, at the Korea Credit Bureau was apparently paid by a broker to hand over a massive cache of stolen data. Ironically, Park had been hired at the private credit ratings company to help improve its security system to prevent fraud.
Park downloaded information from 104 million credit card users’ accounts from the three companies and sold data from 78 million of them to a loan lender, surnamed Cho, for 16.5 million won ($15,411).
Of the 78 million accounts Cho purchased from Park, the broker sorted through the information considered valuable, such as registration and credit card numbers, and sold data from about a million NH card account to another loan provider for 23 million won.
Cho and Park were both indicted for illegally trading personal data and are awaiting trial.
The financial observers say it has been years since illegal brokers involved in leaking personal information have formed a black market.
As demand for this kind of personal data increases, so have illegal rings dedicated to its acquisition and sale.
“The market in which telemarketing firms extract clients’ data and sell it to brokers has been around [for years],” said a 40-year-old worker, surnamed Kim, who has worked in the loan business for eight years. “Some brokers know other brokers who work at financial groups, so that opens a window for them to gain personal data in a systematic way.”
The authorities say they are aware of the leaks by employees at financial companies but have acknowledged that it is a practice that is difficult to curb.
“For major financial firms, where it is virtually impossible to extract personal data through hacking, it is mostly employed workers who leak private information in exchange for money from illegal brokers,” said a detective who specializes in information theft in Seoul.
The official spoke on the condition of anonymity.
In a country known for its ubiquitous Internet use, many find it relatively easy to access stolen data.
Finding an online bulletin board where brokers advertise the sale of stolen data can be accomplished through a simple search on a portal site.
On one bulletin board, where brokers leave posts for data trading, a broker left his user name for an Internet messaging program.
When the JoongAng Ilbo contacted the broker and asked for the personal data - which included resident registration numbers, home addresses and mobile phone numbers - the seller offered to send a sample of 20 such accounts so the newspaper could verify the leaked information.
At those forums, or bulletin boards, brokers boasted about the authenticity of the stolen data and left their user names for online chat programs.
One broker contacted by the JoongAng Ilbo said he could provide personal data that is subdivided by financial history.
“We have sorted out the information across many different categories, ranging from those with loan service history to those who have paid for online gambling sites,” the broker said.
The seller added that “sorted” stolen data is sold at a premium rate.
However, authorities have stated that it is simply impossible to crack down on all online forums to rein in illegal trading.
“We just can’t check all the Internet boards,” said an official on the Cyber Terror Response Team at the National Police Agency. “And even if we force a board operator to shut down these sites, brokers will simply move to another board or create one of their own.”
BY PARK YU-MI, LEE SANG-HWA [firstname.lastname@example.org]