Facial-recognition data for 408 people and security information for 14,957 CCTV cameras were among records leaked from Korea Electric Power Corporation (KEPCO), according to material obtained by South Korean opposition lawmaker Yun Jae-ok. The allegations widen the scope of an employee-data leak the state-run utility disclosed earlier this month.
The facial-recognition records were used by KEPCO employees to enter company buildings. The exposed CCTV information included the cameras’ internet addresses, account IDs and passwords. KEPCO has not identified who downloaded the facial data and CCTV credentials or how many times they were downloaded, The Chosun Daily reported.
On October 4, KEPCO said the names, organizational affiliations and phone numbers of approximately 24,000 employees had been exposed, but that “unique identification numbers or sensitive information were not exposed.” It had not revised that statement when the new details emerged.
In a report to the National Assembly, KEPCO said it had been unable to announce the other leaked information “because it took time to confirm what it was.” Yun’s opposition People Power Party said KEPCO was effectively concealing that sensitive information had been leaked.
KEPCO’s internal audits had already flagged access-control weaknesses. Self-audit reports from 2024 to 2026 found eight instances in which staff from unauthorized contractor companies accessed KEPCO’s internal systems with employees’ IDs and passwords. As a result, 114 employees were disciplined, 1,037 received warnings and 760 received cautions, and the contractors were fined a total of 905 million won.
In an April audit report, KEPCO cited major personal-data leaks at Coupang, where about 33.7 million accounts were exposed, and at SK Telecom. It warned that a leak of customer or key power-grid information from a public institution would bring “much greater criticism and responsibility than private companies.”
“This large-scale sensitive information leak at KEPCO is a man-made disaster that was predicted due to a lack of security awareness,” Yun said, adding that KEPCO “is only hastily trying to downplay the severity of the incident.” The leaked records span both the biometric data employees use to enter KEPCO buildings and the credentials that control access to the utility’s surveillance cameras.
Sources: The Chosun Daily
–
By the ID Tech Editorial Team
