Kepco Says Personal Data of All 22,000 Employees Was Exposed Online

Korea Electric Power Corp. said personal information belonging to its entire workforce was exposed on a specific webpage, prompting the state-run utility to remove the page and begin a joint investigation with government authorities.

The exposure affected about 22,000 employees, according to the company. Kepco said the information became visible at around 4 p.m. on Oct. 1 and included seven categories of employee data. The disclosed details included names, contact information, email addresses and positions within the organization.

Kepco said it deleted the webpage immediately after discovering the problem. It is now working with state agencies to determine how the information was exposed and to examine the circumstances surrounding the incident. The company did not provide a timetable for completing the investigation in its initial account.

The utility has also advised employees to exercise caution when receiving phone calls, emails or text messages. The warning is intended to reduce the possibility of secondary harm arising from the exposed information. Names, workplace roles and contact details can potentially be used to make unsolicited communications appear more credible, making employee vigilance an immediate part of the response even as the technical and procedural review continues.

Kepco emphasized that the incident did not expose employees’ resident registration numbers or home addresses. It characterized the material that appeared online as general company-related information rather than sensitive personal information. The distinction limits the categories of data known to have been involved, although the company is still treating possible follow-on misuse as a concern and has urged staff to scrutinize incoming communications.

The incident places data handling at one of South Korea’s largest public corporations under renewed attention. The immediate priorities are to establish why information covering the full workforce was accessible, confirm the complete scope of the exposure and determine whether anyone obtained or misused the data while the webpage was available.

For employees, the company’s guidance means taking extra care with unexpected requests that arrive through channels included in the exposed records. For Kepco, the joint inquiry will be central to explaining how a webpage came to display seven categories of staff information and what safeguards will be needed to prevent a recurrence. The company had not announced evidence of secondary damage in the initial report.