GS E&C data breach exposes blind spots in Korea's smart apartments

GS Engineering & Construction detected unauthorized external access to a system managing apartment community-facility reservations last Wednesday. The incident has raised concerns about the security of digital services used in Korea’s apartment complexes, where residents’ personal and access-related information is collected. The full extent of the exposure remains under investigation, and experts say similar systems used by other builders and public housing operators may also warrant review.

Apartments accounted for 65.8 percent of all homes in Korea, according to 2025 data from the Ministry of Data and Statistics.

The potentially exposed information included residents’ names, dates of birth, contact details, residential status, household-head status and RFID card numbers.

GS E&C said passwords were among the affected information but were encrypted.

GS E&C operates the Xi Home platform, while Hyundai Engineering & Construction, Samsung C&T and Daewoo Engineering & Construction offer similar services.

Youm Heung-youl, an emeritus professor of information security at Soonchunhyang University, said existing safeguards such as certified Internet of Things devices and separation between internal and shared networks may not be sufficient.

Published Nov 2, 2026 3:50 pm KST

Updated Nov 2, 2026 4:22 pm KST

When Park, a 56-year-old homemaker living in an apartment complex in Suwon, Gyeonggi Province, heard that GS Engineering & Construction (GS E&C) had recently detected unauthorized access to a system containing residents’ personal information, the news struck a nerve.

“Sure, I’ve had my personal information exposed in the Coupang and SK Telecom data breaches, among many others. Over time, I found myself becoming less concerned. Everyone seemed to be getting hit, and it felt like I was just another number in a database,” she said.

This time, however, it felt much closer to home, quite literally.

“The information involved could reveal details about my own household. Our apartment complex, like many newer developments, relies on smart home services for everyday tasks. We use an app to track package deliveries and vehicle entry and exit, another to access the building, and I hear the sports center is introducing facial recognition for entry. If that kind of information gets exposed, it feels like someone might actually be able to track my every move.”

Her concerns point to a growing vulnerability in a country where apartment living and digital technology are increasingly intertwined. Apartments account for a staggering 65.8 percent of all homes in Korea, according to 2025 data from the Ministry of Data and Statistics.

As residential complexes adopt digital systems for everything from identity verification and building access to household device controls, they are also collecting more detailed information about residents and their routines.

The security implications came into focus last Wednesday, when GS E&C said it had detected unauthorized external access to a system used to manage reservations for apartment community facilities.

The potentially exposed data goes beyond basic identifying details, such as residents’ names, dates of birth and contact information. It also includes information about their residential status, whether they are the head of their household and radio-frequency identification (RFID) card numbers. Passwords were also listed among the affected information, although the company said they were encrypted.

The full extent of the exposure remains under investigation.

A panoramic view of apartment complexes in Seoul's Seongbuk District, Sunday / Yonhap

Over the years, major construction companies have expanded their digital services for residents, offering platforms that combine smart home controls with building access, visitor registration and reservations for shared facilities. GS E&C operates its “Xi Home” platform, while Hyundai Engineering & Construction, Samsung C&T and Daewoo Engineering & Construction offer similar services across their apartment complexes.

As these services have proliferated, however, information security may not have kept pace with the expansion, experts say, as construction has traditionally been viewed as a building-focused sector.

The risks extend beyond the exposure of personal identifiers. RFID card numbers can be linked to systems controlling access to apartment buildings and shared facilities, while some complexes are starting to use facial recognition and other biometric data for entry.

“RFID cards are used to control access to apartment buildings and shared facilities like saunas and gyms,” said Youm Heung-youl, an emeritus professor of information security at Soonchunhyang University.

“The risks are even greater with facial recognition. Although there is no indication that biometric information was compromised in the GS E&C incident, its exposure could create further privacy risks, including the potential misuse of facial data in AI (artificial intelligence)-generated images.”

The potential impact could also extend beyond a single apartment complex.

“This is unlikely to be a problem limited to GS E&C. Other construction companies and public housing operators use similar systems. If multiple apartment complexes share a platform, a breach affecting one complex could spread to others. We need to examine whether these platforms are being managed securely,” he said.

The professor called for a broader review of vulnerabilities in apartment management systems and their connections to external networks, noting that existing safeguards — including certified Internet of Things devices and separation between internal and shared networks — may not be sufficient.

[EXPLAINER] How AI emerged as new threat in Korea's bank hacking crisis

上周三，GS工程建设公司检测到其公寓社区设施预订管理系统遭到未经授权的外部访问。此次事件引发了人们对韩国公寓社区所用数字服务安全性的担忧，因为这些服务会收集居民的个人信息和访问相关信息。目前，此次事件的影响范围仍在调查中，专家表示，其他建筑商和公共住房运营商使用的类似系统也可能需要进行审查。

根据韩国数据统计部2025年的数据，公寓占韩国所有住宅的65.8%。

可能泄露的信息包括居民姓名、出生日期、联系方式、居住状况、户主身份和 RFID 卡号。

高盛工程建设公司表示，密码也包含在受影响的信息中，但密码已被加密。

GS E&C 运营 Xi Home 平台，而现代工程建设、三星物产和大宇工程建设提供类似服务。

顺天乡大学信息安全荣誉教授严兴烈表示，现有的安全措施，如经过认证的物联网设备以及内部网络和共享网络之间的隔离，可能还不够。

发布于2026年11月2日下午3:50（韩国标准时间）

更新于2026年11月2日下午4:22（韩国标准时间）

56岁的朴女士是京畿道水原市一处公寓楼的住户，当她听说GS工程建设公司（GS E&C）最近发现有人未经授权访问包含居民个人信息的系统时，这个消息引起了她的警觉。

“没错，我的个人信息也曾在Coupang和SK Telecom的数据泄露事件中被曝光，还有其他很多类似事件。随着时间的推移，我发现自己越来越不担心了。似乎每个人都受到了影响，感觉自己就像数据库里的一个数字，”她说道。

然而，这一次，感觉离家更近了，毫不夸张地说。

“这些信息可能会泄露我家里的隐私。我们住的公寓楼，和很多新建楼盘一样，日常生活都依赖智能家居服务。我们用一个应用程序追踪包裹递送和车辆进出情况，用另一个应用程序进入大楼，我还听说体育中心也要引入人脸识别门禁系统。如果这类信息泄露出去，感觉好像有人真的能追踪我的一举一动。”

她的担忧表明，在一个公寓生活与数字技术日益交织的国家，脆弱性正在加剧。根据韩国数据统计部2025年的数据，公寓占韩国所有住房的惊人比例——高达65.8%。

随着住宅小区采用数字化系统来处理从身份验证、楼宇门禁到家用设备控制等各种事务，它们也在收集有关居民及其日常生活的更详细的信息。

上周三，GS E&C 表示，他们检测到未经授权的外部人员访问了用于管理公寓社区设施预订的系统，安全隐患由此凸显。

可能泄露的数据不仅限于居民姓名、出生日期和联系方式等基本身份信息，还包括他们的居住状况、是否为户主以及射频识别 (RFID) 卡号。受影响的信息中也包括密码，尽管该公司表示密码已加密。

暴露的全部范围仍在调查中。

周日，首尔城北区公寓楼群全景 / 韩联社

多年来，各大建筑公司不断拓展面向住户的数字化服务，推出集智能家居控制、楼宇门禁、访客登记和共享设施预约于一体的平台。GS E&C运营着“Xi Home”平台，而现代工程建设、三星物产和大宇工程建设则在其公寓项目中提供类似服务。

专家表示，随着这些服务的激增，信息安全可能并没有跟上发展的步伐，因为建筑业历来被视为一个以建筑为中心的行业。

风险不仅限于个人身份信息的泄露。RFID卡号可以与公寓楼和公共设施的门禁系统关联，而一些小区已经开始使用面部识别和其他生物识别数据进行门禁管理。

“RFID卡用于控制公寓楼和桑拿浴室、健身房等共享设施的访问权限，”顺天乡大学信息安全荣誉教授Youm Heung-youl说。

“面部识别技术的风险更大。虽然没有迹象表明GS E&C事件中生物识别信息遭到泄露，但其暴露可能会造成进一步的隐私风险，包括在人工智能生成的图像中滥用面部数据。”

潜在影响可能不仅限于单个公寓楼。

“这不太可能只是GS E&C一家独有的问题。其他建筑公司和公共住房运营商也使用类似的系统。如果多个公寓楼共用一个平台，那么一个公寓楼一旦出现安全漏洞，就可能蔓延到其他公寓楼。我们需要检查这些平台的管理是否安全，”他说道。

该教授呼吁对公寓管理系统及其与外部网络连接的漏洞进行更广泛的审查，并指出现有的安全措施（包括经过认证的物联网设备以及内部网络和共享网络之间的隔离）可能还不够。

【解读】人工智能如何成为韩国银行黑客危机中的新威胁