Expansion of membership at companies’ own online storesGrowing concerns they could become targets for hackersMany companies invest less in information security than the industry averageReviewing internal vulnerabilities… establis
Following a series of cyberattacks targeting the financial sector, including banks, insurers and financial investment firms, concerns about personal information leaks are also growing in the food sector, which is closely tied to people’s daily lives. In recent years, food companies have expanded their sales channels through their own online stores. As a result, they are reviewing their internal systems and preparing countermeasures, including increasing investments in information security and establishing new related teams.
According to industry sources on November 4, The Born Korea announced on its official website that unauthorized and illegal external access had occurred from November 2 to a backup server managed and operated through an outside service provider, Douzone Bizon, and that personal information may have been leaked. The information potentially exposed includes business partners’ email addresses, phone numbers, bank names, account numbers and account holders’ names, as well as the names, resident registration numbers, addresses, contact details and account numbers of current and former employees. The Born Korea said that information related to customer inquiries may include names, mobile phone numbers, email addresses, inquiry details and store addresses. On October 16, coffee chain Hollys confirmed that an external party had gained unauthorized access to its membership system and leaked customer information. Three days later, it announced that approximately 2.76 million records had been affected. The nine types of exposed information were user IDs, passwords, names, dates of birth, phone numbers, addresses, email addresses and duplicate subscription verification information (DI). Awareness of data breaches across industries grew after Coupang suffered a massive personal information leak involving more than 33 million records last year, but similar cases continue to occur across the retail sector. Recently, unauthorized access exploiting a vulnerability in an external service application programming interface (API) at Gmarket resulted in the exposure of customers’ names, contact details, addresses and e-coupon PINs. Giftiel, which issues and sells mobile gift certificates for brands affiliated with Lotte Group, was also hacked, exposing names, mobile phone numbers, email addresses and refund account numbers. Earlier, customer information was leaked at 29CM, operated by Musinsa, and BGF Networks, the parcel delivery operator for convenience store chain CU, which is operated by BGF Retail. As online shopping becomes commonplace, manufacturers in food, fashion and beauty, as well as online marketplaces, are strengthening their own online stores and focusing on expanding their membership. Some observers say this makes them easy targets for groups seeking to steal personal information for malicious purposes. “From a company’s perspective, the more members it has, the more data it can accumulate on their search and purchasing habits. It can then provide targeted advertisements or information to increase purchase rates. In that sense, customer information is a business asset that can directly generate revenue,” an industry official said. “Companies can boost the effectiveness of their marketing through relatively inexpensive methods, such as discount coupons or reward points, while consumers can buy products at even slightly lower prices. This has made people relatively willing to provide their personal information in exchange for such benefits.” Industry companies are stepping up investments in information security to respond to increasingly sophisticated cyberattacks. However, there are significant differences among companies, and a considerable number invest less or have fewer dedicated staff than the average for their industries. According to the Korea Internet & Security Agency’s (KISA) Information Security Disclosure Portal, CJ CheilJedang has the largest information security investment among food companies. As of 2026, its related investment totaled KRW 6.9 billion, up 21.8% from last year. SCK Company, the operator of Starbucks in Korea, followed with KRW 5 billion, while Lotte Wellfood invested KRW 3.5 billion and Lotte Chilsung Beverage KRW 3.3 billion.
According to the Ministry of Science and ICT’s 2025 Information Security Disclosure Status Report, the average information security investment was KRW 2.5 billion in the “manufacturing” sector, which includes major food manufacturers, and KRW 1 billion in the “other” sector, which includes coffee chains. The companies listed above exceeded these averages. By contrast, many companies required to disclose their information security investments spent less than the industry average, including Daesang (KRW 2.2 billion), Ottogi (KRW 1.2 billion), Nongshim (KRW 1 billion), Shinsegae Food (KRW 1 billion), Orion (KRW 400 million), Samlip (KRW 400 million) and The Born Korea (KRW 300 million). As of 2025, the average number of dedicated information security staff was 8.3 in manufacturing and 3.9 in other industries. Only CJ CheilJedang (41.6) and SCK Company (17.4) were above those averages. Retailers have been tightening checks for security vulnerabilities in response to a series of recent hacking incidents. CJ CheilJedang, for example, said, “Recently, repeated attacks have increased on our online store, CJ The Market, including automated vulnerability scans using artificial intelligence (AI) and large-scale login attempts. We have strengthened our ability to detect and block abnormal access patterns and repeated requests, and we are operating a system to block bot-based login attacks.” Last month, SCK Company established digital affairs and information security center teams as part of Shinsegae Group’s 2027 regular executive appointments and organizational restructuring. The group said the move was “intended to strengthen expertise by establishing an integrated IT management system, and to enhance capabilities in personal information protection and information security.”
“Two Spend 500,000 Won in a Flash, Yet Wait Two Hours?” … ‘Dreamland’ Shunned by Kids and Foreign Tourists
Nongshim, meanwhile, will discontinue its ID-based unified membership system, which had been used on its official website, brand stores, Noodle Foodle and Coco Ichibanya, starting in December. It will also eliminate separate membership registration and login procedures. “This is a measure to better protect our customers’ valuable personal information in line with the recent trend toward stronger privacy protections,” a Nongshim representative said. “We will securely destroy customer information currently in our possession in accordance with relevant laws and regulations and our policies.”
This content was produced with the assistance of AI translation services.
© The Asia Business Daily. All rights reserved. Unauthorized AI training and use prohibited.
Click Here For The Original Source
——————————————————–
