CJ Group has confirmed that employees' personal information was leaked via Telegram and is preparing to report it to investigative and related authorities.

Industry sources said on May 18 that the names, ranks, mobile phone numbers and photos of about 330 female CJ Group employees were distributed through a public Telegram channel opened in May 2023. Many of those, excluding former employees, were identified as information of current staff. The public channel has about 2,800 participants. A separate private channel is also believed to be in operation.

Some posts were uploaded with an intranet access URL included. Detailed information such as work location and working hours was also partially exposed.

CJ Group suspects the leak was caused by an insider rather than external hacking. It has been suggested the leaker may have queried and collected intranet information based on employee ID values.

The company is also preparing to report the case to investigative and related authorities. Article 34 of the Personal Information Protection Act requires reporting to the Personal Information Protection Commission or the Korea Internet and Security Agency within 72 hours of becoming aware of a leak involving personal information of 1,000 people or more.

Some have also pointed to a lack of internal controls for failing to detect the leak of employee information over three years. Article 30 of the Enforcement Decree of the Personal Information Protection Act sets out obligations for safety measures, including restrictions on access rights to personal information processing systems and detection of abnormal access. Violations can result in a penalty of up to 3 percent of total sales.

A CJ Group official said the company is investigating the exact cause of the incident and the leak route and is preparing to report it to investigative and related authorities. The official said the company takes the matter seriously and will do its best to prevent harm.