Over 100 million won stolen through identity theft via personal information posted in SNS chatting groups.

Created with Microsoft Bing Image Creator powered by DALL-E

Over 100 million won stolen through identity theft via personal information posted in SNS chatting groups. 

        In Korea, a man was arrested for using personal information published by an insurance company on the SNS (Social Networking Service) to fraudulently steal money using identity theft. The incident arose due to an insurance agency posting their customers' personal information in an SNS group chat room, which included the victim's ID, credit card information, and insurance contract. The suspect used this personal information to fraudulently create a mobile phone number in the victim's name, then proceeded to create bank accounts, mobile certificates which was subsequently used to borrow over 100 million won through open-banking and loans. This incident demonstrates potential vulnerabilities in user-friendly fintech (financial services based on advanced information technology), as well as the need for insurance associations to provide greater education and possible regulation on handling sensitive personal information. 

        Such vulnerabilities in SNS websites are not new: just last year, there were reports of hackers targeting public SNS profiles such as in LinkedIn and Clubhouse due to the information in those profiles - names, ID, birthdates. For instance, a user on a popular hacking forum is asking for $100,000 for a database of 3.8 billion user records that combined phone numbers from Clubhouse and user profiles from Facebook. Although such information is not dangerous by itself and are often posted publicly by users, when combined with other information, they can lead to serious cybercrimes and identity theft. Examples of ways scammers could use this information is to run 'localized mass campaigns' or 'personalized scams'. Moreover, companies often deny that such an incident is a hacking or data breach incident, as the hackers are 'scraping' publicly available information rather than accessing secure and protected information. Since the information by itself may not constitute a serious threat to privacy or identity theft, it can be difficult to both regulate and determine if there is a risk. Especially regarding profiles, which are intended to provide some personal characteristics to attract attention or help other people understand the user at a quick glance, it can be very difficult to balance the protection of personal information and regular SNS activity by both the company and users. 

        That being said, other countries such as the EU have precedents protecting such data. In the EU, this kind of information is called 'indirect identification': when the information alone cannot identify an individual, but it can through combination with other pieces of information (which one can reasonably access). This type of information is also considered as 'personal data' since it can still identify an individual, and thus the GDPR's protections against processing personal data apply to them as well. Applying such standards to these scenarios where hackers 'scrape' large quantities of publicly available indirect information could result in greater awareness and more prevention measures taken to limit the possible harm.