A South Korean insider incident has seen a National Health Insurance Service (NHIS) employee dismissed for illegally selling personal information of health insurance subscribers to external parties for bribes.
The disclosures indicate the employee supplied data on subscribers and their dependents to third parties for more than two years, with a currency figure described as “an amount in the hundreds of millions of won.” The breach is framed as an insider threat, rather than a cyberattack, and the offender was removed from the organisation in July.
Victims have not been informed about the breach or its details for three months. Under the Personal Information Protection Act, data handlers are required to notify affected individuals of the breach’s specifics and preventive measures within 72 hours of discovery. The report notes this failure to inform as a breach of regulatory requirements, and the matter was raised during a parliamentary audit by Rep. Kim Ki-woong of the People Power Party.
NHIS’s response, via Executive Managing Director Jeong Jae-wook, confirms the insider activity and the high bribe amount but does not detail how many individuals were affected or the scope of the data exposed. The article points to coverage in The Chosun Daily for additional context.