Notice of a Potential Personal Information Breach
Notice of a Potential Personal Information Breach
Dear Valued Clients,
BDO Sunghyun LLC (the "Firm") received notification from Douzone Bizon Co., Ltd. ("Douzone Bizon") on October 28, 2026 regarding its data backup service (APO), which was previously used by certain departments of the Firm that provide outsourced services to client companies. The notification stated that an external intrusion into the server used for the service had occurred and that personal information may have been disclosed without authorization. The Firm's contract for this service ended on December 31, 2025, and the Firm no longer uses it. This incident occurred on Douzone Bizon's backup server and is unrelated to the Firm's other business systems.
In accordance with the Personal Information Protection Act, we hereby provide the following notice.
1. Timing and Circumstances of the Suspected Personal Information Breach
• Date and time of occurrence: The exact date and time of the intrusion are under investigation by Douzone Bizon.
• How the Firm became aware: On October 28, 2026, the Firm was notified by Douzone Bizon that it had identified indications that certain encrypted data stored on its backup server had been exfiltrated through a vulnerability in its backup solution. To date, it has not been confirmed whether any data relating to the Firm has been disclosed without authorization.
2. Scope and Categories of Personal Information Potentially Affected
• Scope: Client company data processed by the above departments in the course of providing outsourced services and backed up to the service on or before December 31, 2025.
• Categories of personal information potentially affected: Name, email address, resident registration number, address, payroll information, and year-end tax settlement data.
• According to Douzone Bizon, all data stored on the backup server was encrypted, and no indications of unauthorized disclosure of the encryption keys have been identified.
3. Measures Taken by the Firm
• The Firm has reported the relevant facts to the Personal Information Protection Commission.
• The Firm has requested that Douzone Bizon promptly notify it whether any data relating to the Firm has been disclosed without authorization and provide the results of its investigation.
• The Firm is implementing the necessary measures based on advice from external experts.
4. Steps You Can Take to Minimize Potential Harm
• Beware of impersonation: Please do not respond to any calls, text messages, or emails that impersonate the Firm or Douzone Bizon and request passwords, bank account numbers, authentication codes, or similar information. The Firm will never request such information under any circumstances.
• Please do not open links or attachments from unknown or unverified sources.
• If you are concerned about identity theft, you may register with the Financial Supervisory Service's system for preventing financial incidents involving exposed personal information (개인정보노출자 사고예방시스템, pd.fss.or.kr) to restrict the opening of new accounts and the issuance of new cards.
5. Procedures for Seeking Redress
• If you suspect that your rights relating to your personal information have been infringed, you may seek advice from the Personal Information Infringement Report Center (dial 118 within Korea; no area code required) or apply for dispute mediation with the Personal Information Dispute Mediation Committee (1833-6972, www.kopico.go.kr).
• If you have suffered harm as a result of this incident, please contact us using the details below. After verifying the facts, we will take the necessary steps in accordance with applicable laws and regulations.
6. Contact Information for Inquiries and Reports of Harm
• Department in charge: Management Planning Division
• Personal Information Protection Manager: Jinkyu Kim, Senior Manager
• Telephone: +82-2-513-0200 (Hours: weekdays 09:00–18:00 KST)
• Email: jinkyu.kim@bdo.kr
※ If you have any questions, including whether you are affected by this incident, please contact us using the information above.
7. Further Notice Following Confirmation of the Investigation Results
If Douzone Bizon's investigation confirms that data relating to the Firm has been disclosed without authorization, we will provide further notice without delay in accordance with applicable laws and regulations. If the investigation confirms that no such disclosure has occurred, we will also notify you of that outcome.
We sincerely apologize for the concern this has caused our valued clients. The Firm will respond responsibly to protect the valuable information entrusted to us.
BDO Sunghyun LLC (the "Firm") received notification from Douzone Bizon Co., Ltd. ("Douzone Bizon") on October 28, 2026 regarding its data backup service (APO), which was previously used by certain departments of the Firm that provide outsourced services to client companies. The notification stated that an external intrusion into the server used for the service had occurred and that personal information may have been disclosed without authorization. The Firm's contract for this service ended on December 31, 2025, and the Firm no longer uses it. This incident occurred on Douzone Bizon's backup server and is unrelated to the Firm's other business systems.
In accordance with the Personal Information Protection Act, we hereby provide the following notice.
1. Timing and Circumstances of the Suspected Personal Information Breach
• Date and time of occurrence: The exact date and time of the intrusion are under investigation by Douzone Bizon.
• How the Firm became aware: On October 28, 2026, the Firm was notified by Douzone Bizon that it had identified indications that certain encrypted data stored on its backup server had been exfiltrated through a vulnerability in its backup solution. To date, it has not been confirmed whether any data relating to the Firm has been disclosed without authorization.
2. Scope and Categories of Personal Information Potentially Affected
• Scope: Client company data processed by the above departments in the course of providing outsourced services and backed up to the service on or before December 31, 2025.
• Categories of personal information potentially affected: Name, email address, resident registration number, address, payroll information, and year-end tax settlement data.
• According to Douzone Bizon, all data stored on the backup server was encrypted, and no indications of unauthorized disclosure of the encryption keys have been identified.
3. Measures Taken by the Firm
• The Firm has reported the relevant facts to the Personal Information Protection Commission.
• The Firm has requested that Douzone Bizon promptly notify it whether any data relating to the Firm has been disclosed without authorization and provide the results of its investigation.
• The Firm is implementing the necessary measures based on advice from external experts.
4. Steps You Can Take to Minimize Potential Harm
• Beware of impersonation: Please do not respond to any calls, text messages, or emails that impersonate the Firm or Douzone Bizon and request passwords, bank account numbers, authentication codes, or similar information. The Firm will never request such information under any circumstances.
• Please do not open links or attachments from unknown or unverified sources.
• If you are concerned about identity theft, you may register with the Financial Supervisory Service's system for preventing financial incidents involving exposed personal information (개인정보노출자 사고예방시스템, pd.fss.or.kr) to restrict the opening of new accounts and the issuance of new cards.
5. Procedures for Seeking Redress
• If you suspect that your rights relating to your personal information have been infringed, you may seek advice from the Personal Information Infringement Report Center (dial 118 within Korea; no area code required) or apply for dispute mediation with the Personal Information Dispute Mediation Committee (1833-6972, www.kopico.go.kr).
• If you have suffered harm as a result of this incident, please contact us using the details below. After verifying the facts, we will take the necessary steps in accordance with applicable laws and regulations.
6. Contact Information for Inquiries and Reports of Harm
• Department in charge: Management Planning Division
• Personal Information Protection Manager: Jinkyu Kim, Senior Manager
• Telephone: +82-2-513-0200 (Hours: weekdays 09:00–18:00 KST)
• Email: jinkyu.kim@bdo.kr
※ If you have any questions, including whether you are affected by this incident, please contact us using the information above.
7. Further Notice Following Confirmation of the Investigation Results
If Douzone Bizon's investigation confirms that data relating to the Firm has been disclosed without authorization, we will provide further notice without delay in accordance with applicable laws and regulations. If the investigation confirms that no such disclosure has occurred, we will also notify you of that outcome.
We sincerely apologize for the concern this has caused our valued clients. The Firm will respond responsibly to protect the valuable information entrusted to us.
October 30, 2026
BDO Sunghyun LLC
BDO Sunghyun LLC