Key keywords: 330 CJ female employees personal data, Telegram data trading, cryptocurrency payment for data breach, CJ Group employee privacy leak, South Korean enterprise data leak, dark web personal information transaction, South Korea Personal Information Protection Act, chaebol data management loopholes A high-profile data breach incident has sparked widespread public outcry across South Korea recently, as the sensitive personal data of 330 female employees from CJ Group, one of the country’s largest multi-industry conglomerates with business footprints in food production, entertainment, logistics and retail, was discovered being traded in private, invitation-only Telegram groups, with the seller exclusively accepting cryptocurrency as payment to avoid regulatory tracing. According to official confirmation from CJ Group’s public relations department, the leaked data covers extremely sensitive personal details of the affected female employees, including full legal names, national identity card numbers, personal mobile phone numbers, residential addresses, departmental affiliation, monthly salary records, emergency contact information of family members, and even medical check-up data collected through the company’s employee welfare program and private social media account information submitted for internal communication purposes. The anonymous seller priced the full set of 330 data entries at 0.8 Ethereum, equivalent to approximately $1,420 as of late August 2024, and clearly stated in the trading post that all fiat currency payment requests would be rejected to eliminate the risk of being tracked through bank transfer records. South Korea’s National Police Agency Cyber Security Bureau has formally opened a criminal investigation into the case after receiving a report from CJ Group’s legal team. Investigators are currently working to trace the IP address of the seller who published the trading information, and cooperating with global cryptocurrency transaction monitoring platforms to track related fund flows. People familiar with the investigation revealed that the leak is most likely caused by internal staff misconduct or data system vulnerabilities of third-party service providers cooperating with CJ Group, as the level of detail of the leaked data far exceeds information that can be obtained through external cyber attacks. Under South Korea’s Personal Information Protection Act (PIPA), unauthorized disclosure and trading of other people’s personal information can result in a maximum prison sentence of 7 years and a fine of up to 50 million won. CJ Group has issued a public apology to all affected employees, promised to provide 3 years of free identity theft protection and anti-fraud services for the victims, and launched a full internal review of its employee data management mechanisms. This incident also amplified public concerns about long-standing data security flaws of South Korea’s large conglomerates, as official statistics show that 14 similar employee data leak incidents involving large chaebols were recorded in the first half of 2024 alone.