Asian Privacy Daily Brief - Nov 1, 2022

Asian Privacy Daily Brief - Nov 1, 2022

        Korea's Personal Information Protection Commission (PIPC) is stepping up efforts to monitor and remove photos or videos taken at the scene of the recent Itaewon Halloween crowd crush that reveal identifiable facial imagery to protect personal information rights. Using mosaics to blur out faces is required in Korea to protect privacy rights, and the PIPC intends to ask major companies such as Google, Meta, Naver, Kakao, Twitter, etc to help remove user posts that expose personal information. 

        Korea's Internet and Security Agency (KISA) issued warnings about malware and cyberattacks that exploit the Itaewon Halloween crowd crush incident. For instance, hackers/scammers may send emails pretending to be from government agencies dealing with the Itaewon incident, or hide malware in relevant photos and videos. A fake government emergency-response report containing malware has already been discovered mere hours after the Itaewon incident. This type of attack demonstrates that even - or perhaps, especially - in times of mass societal grief and chaos, people need to raise their security standards to prevent malicious actors from taking advantage of the situation. 

        A new phishing mail attack recently in Korea is a fake NAVER email announcing that the user's ID was suspended, and requesting the user to click on the link within the fake email to re-activate the account. Upon clicking the link, the user is directed to a fake NAVER website that requests personal information. The "your account is being suspended" type of phishing email attack is not new: there are many examples of such attacks in the past, such as emails claiming to originate from Amazon and Facebook. The only difference seems to be which major company is being targeted.