KR: NHIS Employee Sold Data, Victims Uninformed for Three Months
A South Korean National Health Insurance Service employee was fired for illegally selling subscribers' personal health data to outside parties. Despite the breach being discovered, affected individuals had not been notified for at least three months, a lapse revealed during a parliamentary audit.
Why this matters: Health data is some of the most sensitive information a government holds on you. People cannot opt out of a national health insurer. They had no choice but to hand over that data, and they had every right to know quickly when it was sold. Three months of silence is not an administrative delay. It is people being denied the chance to protect themselves. The insider threat here matters, but the notification failure is the part that should make regulators uncomfortable. Who decided not to tell victims, and why?
Who should care: Cybersecurity · Privacy officers · Administrators · General readers · Policy
This summary is AI-assisted and may contain errors. It is an original briefing to help you gauge significance quickly — not a reproduction of the source. Always read the linked original before relying on it. See our methodology.