Korean enterprise software vendor Douzone Bizon said on October 23, 2026 that attackers used a flaw in the backup solution behind its APO backup service to exfiltrate some encrypted data from backup servers, adding that it has found no sign the encryption keys leaked and has not yet identified affected customers or individuals [1]. THE ELEC reports the company confirmed two intrusions on October 16 and 21 and that the government classified the case as a serious breach and formed a joint public-private investigation team, while Boannews lists customers including K Auction, the KLPGA, Kukkiwon and NH NongHyup Bank subsidiary Agilesoda that have warned of possible personal data exposure [2][3]. Douzone Bizon advises affected individuals not to answer calls, texts or emails impersonating it, banks or public agencies, and to register with the FSS exposure prevention system (pd.fss.or.kr) to block new accounts and cards in their name [1].
Korean ERP vendor Douzone Bizon backup service breached, putting many customers' staff and partner data at risk
1 min read
- Disclosed
- Oct 23, 2026
- Published
- Nov 11, 2026
- Last updated
- Nov 13, 2026
- CVSS basis
- Our assessment
- Technology
- Attack vector
- Impact
- Data type
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Industries mainly affected: Technology, Cross-industry
What to do nowOur advice
- Do not respond to calls, texts or emails impersonating Douzone Bizon, banks or public agencies that cite your name or account and ask for money or information, and do not click unknown links .
Timeline
Technical details
Remediation
Vendor guidance
- 1Beware of impersonation scams mitigate[1]
Do not respond to calls, texts or emails impersonating Douzone Bizon, banks or public agencies that ask for money or information.
- 2Register to block identity misuse mitigate[1]
Register at pd.fss.or.kr to restrict new accounts and cards, and use M-Safer to block new phone lines.
- 3Check account activity verify[1]
Review your accounts via www.payinfo.or.kr and request a payment stop on suspicious activity.
References
Official / primary1
- [1]더존비즈온2026-10-23Accessed 2026-11-11Snapshot 2026-11-11 sha256 984bc1805f23
“당사는 이후 내부조사를 진행하여 위 취약점을 통해 백업서버 내 암호화된 일부 데이터가 외부로 반출된 정황을 확인하였습니다.”
Media3
- [2]
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.