Multicampus, a Samsung SDS subsidiary that runs corporate training, has reported a personal data breach to South Korea's Personal Information Protection Commission (PIPC). An outside party got into the cloud environment behind the company's online "Learning Platform" on November 9, 2026. About 70,000 users of that platform are affected. A Multicampus representative confirmed the unauthorized access to The Asia Business Daily. A PIPC official said the commission has received the report and has started a preliminary review. The exposed data includes names and phone numbers. Korean press reports also list email addresses and workplace details such as employee numbers and job titles. No threat actor has been named, and no group has claimed the attack.
What Happened
According to The Asia Business Daily and the Seoul Economic Daily, the unauthorized access to the Learning Platform took place on November 9. Multicampus says it found out about the breach on the night of November 11. That same night it notified its corporate clients and filed a report with the PIPC. The Seoul Economic Daily puts the filing at around 9 p.m. That means roughly two days passed between the intrusion and the report.
A Multicampus representative told The Asia Business Daily: "We confirmed unauthorized access to the cloud environment used for the Learning Platform and notified our clients." Both outlets say the exact scale of the breach will only be known once the investigation finishes. The PIPC has described its work so far as a preliminary review. It has not opened a formal investigation or announced any findings.
Multicampus belongs to the Samsung Group. It designs training courses, supplies learning content and platforms, and runs training programs for companies and public institutions. It also runs OPIc, a speaking proficiency test, in South Korea. The Seoul Economic Daily reports that over the past five years the company has served about 16,000 client organizations in Korea and abroad, and about 26 million learners in total over the past decade.
What Was Taken
Both outlets put the number of affected users at about 70,000. That figure is preliminary, and both say it could change once the investigation is complete. Neither the company nor the PIPC has published a final count.
The two reports list slightly different sets of exposed data:
- The Asia Business Daily: names, phone numbers, email addresses, department names, employee numbers, user IDs, ranks and positions.
- Seoul Economic Daily: names, phone numbers, email addresses, department names and employee ID numbers.
The Seoul Economic Daily also reports that no resident registration numbers (South Korea's national ID numbers) were taken and that no financial losses have been reported. The Asia Business Daily does not say either way. Neither outlet says that passwords were exposed. Since user IDs may have been taken, though, the company has not ruled out that login data was affected.
This is mainly a workplace data set. Each record links a person to their employer, department and rank. That makes it more useful to an attacker than a plain list of contact details.
Why It Matters
This is ready-made material for targeted phishing. A name, work email, phone number, department, rank and employer is enough to write a convincing message aimed at a specific person. The users of a corporate training platform are employees at client companies and public institutions. An attacker can pretend to be Multicampus, a course administrator or the employee's own HR team and send a believable message about course enrollment, certification or OPIc results.
Any harm is likely to show up at Multicampus's clients. Multicampus holds the data, but the people affected work at other organizations. Any phishing, voice phishing or credential-stuffing that follows will hit those client organizations' staff and systems. Security teams at companies that use Multicampus should treat this as a third-party breach that affects their own staff.
It follows a run of similar incidents in Korean education and training. In October, Woongjin Compass, a Woongjin Thinkbig affiliate, disclosed that someone accessed the back office of its Play Discovery platform without authorization. The Asia Business Daily reports that nicknames, phone numbers and emails of about 67,000 members were exposed. The Korea Herald reported in early November that about 15,666 records from three Seoul international schools were exposed in the 2024 PowerSchool breach. The same week Multicampus filed its report, the Korea JoongAng Daily reported that the PIPC fined four Samyang Group affiliates 552 million won in penalty surcharges over a breach affecting about 150,000 people. The commission found the companies kept data they did not need and did not encrypt resident registration numbers. That ruling shows the PIPC is willing to penalize poor security practices once an investigation is complete.
There is no confirmed link to any known group. In October, Kaspersky's Securelist published research on "Operation FlashHole," a Lazarus Group campaign against South Korean organizations in the software, construction and communications equipment sectors. It used spear-phishing and watering-hole attacks. Nothing in the public reporting connects the Multicampus breach to that campaign or to any other actor. The Securelist research only shows that South Korean companies are under steady pressure from capable attackers.
The Attack Technique
Few technical details are public. Multicampus has confirmed only "unauthorized access to the cloud environment" behind the Learning Platform. Neither the company nor the PIPC has said how the attacker got in. Possible routes include stolen or reused cloud credentials, a misconfigured storage resource or API, or an application vulnerability. None of these has been confirmed.
Other recent Korean incidents show common ways in. In the Woongjin Compass case, the company said the intruder got into an administrator back office. Its response was to change the administrator password and suspend suspicious accounts. In the Samyang case, the PIPC found that a hacker used a mail server vulnerability to gain administrator rights and then stole credentials for an internal file server. Whether either pattern applies to Multicampus is unknown until the investigation reports back.
What Organizations Should Do
- If you are a Multicampus client, check your exposure now. Ask Multicampus which of your employees' records were included and which fields were exposed. Then warn those staff directly about phishing that mentions training courses, OPIc or Multicampus.
- Reset credentials and watch for credential reuse. User IDs may have been exposed. Force password resets on the training platform, and check your own identity provider for login attempts with those IDs or work emails. Remind staff not to use the same password on vendor platforms and corporate systems.
- Tighten checks on training-related messages. Add mail filtering and user warnings for messages that look like they come from training vendors. Tell staff to verify any request for a password, payment or personal information through a known channel and not through the link or number in the message.
- Lock down cloud administrator access on your own learning platforms. Require phishing-resistant MFA for all cloud console and admin back-office accounts. Remove long-lived access keys, and alert on unusual logins or large data exports.
- Collect less HR data and limit what you share. Training platforms often don't need employee numbers, ranks or departments. Review what you send to training and HR vendors, and delete records you no longer need. The Samyang ruling shows that keeping unneeded data counts against a company in PIPC enforcement.
- Add breach-reporting deadlines and evidence requirements to vendor contracts. Here, two days passed between the intrusion and the report. Write into contracts how quickly vendors must notify you, which logs they must keep, and how they must share findings, so your incident response does not wait on theirs.
Sources: Exclusive Samsung Also Hacked... Multicampus Personal Data Breach -... | Dissecting Operation FlashHole, a complex attack by Lazarus Secure... | Samsung Affiliate Multicampus Reports Data Breach Affecting 70,000... | Samsung Germany Data Breach: 209,875 Records Exposed HEROIC | Exclusive Personal Data of 67,000 Leaked at Woongjin Compass, a Woo... | Samyang Group affiliates fined over data breach affecting 150,000 p... | Data on 16,000 people compromised at 3 Seoul international schools... | 멀티캠퍼스 바로가기 (고객센터 1544-9001·선릉·세종대 교육장·FAQ) - 바로가기