GS E&C hack exposes construction firms' security poverty
GS Engineering & Construction's apartment reservation system was hacked. With the possibility that some residents' personal information was leaked through its community facility reservation management system, the housing platform security practices of the construction industry have come under scrutiny.
The hack that triggered this incident occurred in GS E&C's reservation management system for residents. According to the company, unauthorized external access took place around 10:15 p.m. on the 28th of last month, and abnormal access was detected and blocked around 11:29 p.m. the same day. Information possibly exposed includes names, dates of birth, phone numbers, email addresses, and home addresses, as well as membership numbers, residence types, household head status, last login IP addresses, RF card numbers, and even administrator IDs. GS E&C is investigating the exact scale and scope of the damage.
ISMS-P is a system that evaluates whether the information security and personal data protection management systems of certified services meet the standards. The scope of what operating services and linked systems fall under review differs from company to company, and certification does not eliminate hacking risks, but it serves as an indicator of a company's basic security level. Samsung C&T's construction division holds certification for its Raemian, HomeNick, and Vind services and its external website, while GS E&C was certified for its Xi and Xi Home customer-facing services. Lotte Construction included its sales and rental systems, POSCO E&C its sales management and customer support systems and external website, and SK Eco Plant its sales, move-in, defect repair, and customer support services within their certification scopes.
Some construction firms have even cut their information security investments. Comparing information security disclosures filed with KISA for 2026 with the previous year, GS E&C's investment last year was about 3.243 billion won, down about 58 million won (1.8%) from the year before. DL E&C fell to about 2.405 billion won, down about 401 million won (14.3%), and POSCO E&C to about 3.215 billion won, down about 187 million won (5.5%). Conversely, some firms increased investment. Lotte Construction boosted its spending by 30.8% to about 1.94 billion won, and IPARK Hyundai Industrial Development by 26.2% to about 1.176 billion won. Hyundai Engineering & Construction increased spending by 0.4% to about 4.224 billion won, while Samsung C&T, on a company-wide basis, invested about 14.973 billion won, up 2.4% from the previous year.
Kim Yong-dae, a professor at the KAIST Graduate School of Information Security, said, "The fundamental principles of security are already well established, almost like a textbook, so following them is what matters," adding, "Companies need to make more proactive efforts to comply with existing systems while developing and deploying products with improved security."
