South Korea Orders Official Probe Into GS E&C Security Breach

The ministry then convened the review committee under the revised Information and Communications Network Act, which took effect on 1 October this year. The committee decided that the authorities would examine the extent of the damage and the cause of the incident. The panel is a statutory body set up to enable a more proactive response to security incidents.

What comes next

If the investigation shows the incident to be serious, the ministry plans to consider forming a joint public-private investigation team. That step would also go through the review committee.

The case matters because it shows how the new rules work in practice: a company that wants to handle a breach internally can now be investigated anyway if the committee finds it necessary. For residents whose data may sit in the affected system, and for other firms that operate customer-facing platforms, it signals that self-reporting to KISA no longer guarantees that the analysis stays in the company's hands. The ministry has not yet said what the investigation has found.