Taekwang Admits OneDrive Account Data Leak

Taekwang Network Information, a South Korean network-integration and information-security firm, has confirmed that personal data leaked from one of its Microsoft 365 OneDrive work accounts after someone gained abnormal external access to it around 12 October. In a notice posted to its website on 21 October, and reported by security outlet DailySecu, the company said part of the material stored in that account was taken, that it has disabled the account and blocked further access, and that it has reported the incident to South Korea’s Personal Information Protection Commission and the Korea Internet & Security Agency.

The admission matters because of who Taekwang is and what came before it. The firm builds and maintains networks and supplies security equipment to a range of Korean organisations, and its official notice lands four days after the Everest extortion group named the company on its dark-web leak site, claiming to hold 263.71GB and 54,581 files. The company has verified far less than the attacker asserts, and the two accounts of what happened have yet to align.

In brief

Taekwang Network Information says a Microsoft 365 OneDrive work account was accessed by an outsider around 12 October and some stored files were taken.
The only personal data it has confirmed leaking is a contact’s name with a mobile number or email address; it has notified the PIPC and KISA.
The Everest group separately claims 263.71GB and 54,581 files, including customer network material; that haul is unverified and no ransomware encryption has been confirmed.

What the company has actually confirmed

The verified facts are narrow. By the company’s own account, the breach was an identity problem at the cloud edge: an outsider reached a single Microsoft 365 OneDrive account used for work, and a portion of the files kept there went out. The personal information Taekwang says it can confirm leaking is limited to a contact’s name together with a mobile number or an email address. It has not published how many people are affected, how the account was first reached, or whether multi-factor checks were bypassed. Alongside the regulatory notifications, the firm told readers to be wary of anyone impersonating it to request payments or account changes off the back of the stolen contact details.

Why a network integrator is a high-value target

A systems integrator is a concentrated store of other organisations’ secrets, which is what makes this category of breach worth watching from a compliance and supply-chain standpoint. In the course of designing and maintaining client networks, such a firm routinely handles diagrams, IP schemes, firewall policies, remote-access methods and sometimes credentials. Everest’s listing claims exactly that kind of material, and if any of it were genuinely exposed, the risk would travel downstream to the clients rather than staying with the vendor. That is the recurring lesson of third-party incidents TSN has tracked, from PwC’s disclosure of a cyber incident at a vendor holding staff learning records to Japan’s Digital Agency warning that a contractor breach may expose thousands of entries. It also mirrors the cloud-account route seen when Fisher & Paykel Healthcare said two staff email accounts and files were hacked. For Korean clients, the practical response is a review of what they shared with the integrator and which maintenance or remote-access paths are still live, regardless of whether the attacker’s wider claims hold up. Under Korea’s data-protection regime, the PIPC and KISA notifications start a clock on investigation and potential penalties.

The gap between the claim and the confirmation

The distance between the two stories is the real story. Everest, a Russian-speaking data-extortion crew that security analysts say has shifted towards selling network access, trades on pressure: it lists a victim, starts a countdown and threatens to publish. Its 263.71GB figure, like the file list behind it, rests on the group’s own word, and such tallies can be padded with old project files or public documents. Taekwang, for its part, confirms only a limited leak from one OneDrive account and has said nothing that squares with the attacker’s inventory, much as Citizens Bank handled a breach that Everest was linked to by confining its statement to what it could verify. No encryption of Taekwang’s systems has been established, which fits Everest’s extortion-first pattern rather than a classic ransomware lockout.

What to watch is whether the regulators’ findings reconcile the attacker’s claimed haul with the single-account leak the company admits, and whether any client data is ever confirmed taken. Until then, the confirmed breach is real but small, and the larger figure remains a claim on a countdown.