Institutions collect the data. People bear the burden when it leaks.

Outsourcing a system does not remove the duty to protect its users

Academic activity is no exception. In an October 8 notice to members, the Korean Institute of Culture Architecture said it had identified indications of a personal-data breach following abnormal external access the previous day. The listed information included names, user IDs, dates of birth, encrypted passwords and contact details, as well as bank account numbers and mailing addresses. Information supplied for membership had been exposed to the risk of misuse outside academic activity.

The full scale of that incident and any connection to other academic societies have not been established. That does not justify postponing accountability. Members need a concrete explanation of which information was exposed, how far the investigation has progressed and what the operator has done to reduce further risk.

An education-platform incident also illustrates the risks of outsourced operations. According to Malgnsoft’s account, its server was breached on September 19 and personal information was stolen on September 20. The company became aware of the attack on September 22, after a text-message provider reported abnormal sending activity. Detection therefore followed the intrusion and data theft. Malgnsoft reported measures including access blocking, vulnerability fixes and two-step authentication for administrators. No evidence has established that this was the same incident as the academic-society breach described above.

Different websites can depend on the same vendor’s servers and management systems. Checking only the development price and service availability is insufficient. Institutions must verify whether member data is separated, whether administrators can access only what they need and whether bulk queries and downloads are detected. The institution that entrusted data to a contractor must do more than relay the contractor’s explanation. It must establish that protective measures work.

A completed investigation has already demonstrated the consequences of gaps in inspection. In January this year, South Korea’s Personal Information Protection Commission published its findings on a June 2025 breach affecting about 120,000 members of the National Research Foundation of Korea’s JAMS online journal-submission system. Inspections focused on the main portal while more than 1,600 academic-society pages were omitted. The regulator identified a long-standing vulnerability and deficient breach notification, and reported subsequent misuse of members’ identities.

The security of a main website cannot stand in for an assessment of the entire service. Membership screens, password-reset functions, employee work systems and old standalone sites also hold personal information. The actual paths through which information is stored and moves must determine the scope of inspection. A record that an inspection took place does not, by itself, demonstrate adequate protection.

An apology must be followed by verifiable improvements

Breach notifications must also improve. Encryption status and any financial losses established so far are relevant. But they do not fully explain the risk people face. Institutions must specify the affected information and users, the known scope of access and the matters still under investigation, then update their notices as facts emerge. A notice that leaves people guessing about their own exposure is not an adequate response.

Users must take steps to reduce immediate harm. Accounts sharing the affected service’s password need distinct new passwords, with particular attention to email accounts used to recover other accounts. Users should visit their usual official website rather than follow a link in a message claiming to be a breach notice. A caller’s knowledge of someone’s name or membership is not proof of legitimacy. In South Korea, suspected text-message phishing can be discussed with the 118 helpline, while financial losses should be reported immediately to the police on 112.

Individual vigilance cannot fix a server vulnerability or recover information already stolen. Institutions that tell users to change passwords must also be required to provide evidence of their own response. That means verifying that the intrusion route has been closed, all affected systems have been investigated and the same weakness does not remain elsewhere.

Supervision must go beyond incident counts and financial penalties. Time to detection, the accuracy of the first notice, inspection of omitted systems and completion of corrective measures must inform follow-up oversight. Institutions should assign accountable owners and deadlines, and contractors should provide evidence that their remedies have been implemented.

The authority to collect personal information carries an enduring responsibility to protect it. Neither outsourcing the service nor the fact that an attacker broke in should shift that responsibility onto users. What is needed is an accountability system that changes the organisations and operating practices behind repeated failures.