韩国ERP龙头Douzone Bizon五天内两遭网络攻击，备份系统被突破，政府定性重大安全事故启动民官联合调查

Douzone Bizon suffered a second cyberattack just five days after an earlier breach, with attackers also penetrating its backup system, considered a last line of defense for data security. The South Korean government classified the incidents as serious cybersecurity breaches and launched a joint public-private investigation team.
Douzone Bizon posted an apology on its website on Oct. 26, signed by co-CEOs Lee Kang-soo and Ji Yong-goo. “We sincerely apologize for the significant concern caused to our customers by recent unauthorized external access to our systems,” the executives said. “We will review our data management procedures and access control systems.”
The Ministry of Science and ICT convened an incident review committee on Oct. 25, classified the breaches as serious cybersecurity incidents and established a joint public-private investigation team. The team includes officials from the ministry and the Korea Internet & Security Agency (KISA), along with private-sector experts in cybersecurity, systems and networks. It will investigate the causes, extent of damage and potential spread of the breaches to customer companies.
Douzone Bizon confirmed two security breaches on Oct. 16 and 21 and reported them to KISA and the Personal Information Protection Commission.
The first incident occurred on a development server for Smart A10, the company’s accounting and tax software. In a notice issued on Oct. 18, the company said it had detected signs that an unidentified individual used an employee’s virtual private network (VPN) account to gain unauthorized access to internal systems and view data.
Information considered at high risk of exposure includes names, resident registration numbers, bank account numbers, addresses, mobile phone numbers and email addresses held by some customers. The company said the last six digits of resident registration numbers and bank account numbers were encrypted. At the time, Douzone Bizon said it was difficult to identify the affected customer companies and individuals.
The second incident was discovered in APO Backup, the company’s data backup service. On Oct. 26, Douzone Bizon issued a notice about the security breach and the possibility of personal information exposure.
The company said it detected suspicious activity during a service inspection and contacted Ahsay, its backup software provider. After being informed of a vulnerability in the software, Douzone Bizon conducted an internal investigation and found indications that some encrypted data stored on its backup servers had been transferred externally through the vulnerability.
The company added that the backup data was encrypted and that it had found no evidence of encryption keys being compromised.
Ahsay recently released security patches for two vulnerabilities in its backup software, CVE-2026-105133 and CVE-2026-105134. However, Douzone Bizon did not confirm whether those vulnerabilities had been exploited in the incidents. It also declined to answer questions about the extent of the damage and the status of customer notifications.
Asked about the scope of the Smart A10 breach, the company said only that the investigation was still underway.
“Our preliminary investigation has identified the possibility that some personal information was exposed, but we are not yet in a position to confirm whether data was actually leaked,” a Douzone Bizon official said. “If a leak is confirmed, we will immediately provide further notification and take the necessary measures.”
“A full investigation by the joint public-private team is scheduled,” the official added. “We will ensure that the precise circumstances of each security incident are established through the investigation.”
Douzone Bizon is an enterprise software provider supporting core business operations, including accounting, taxation, human resources and payroll, for South Korean companies. It had more than 150,000 corporate customers as of 2024. Determining the extent of the breaches has become urgent because personal information and data stored in corporate business systems could be exploited in secondary attacks.