Korea’s Apartment Data Breach Puts Society Apps on Notice
A hacker got into GS E&C’s apartment booking system in Korea and saw who lives where. Indian housing societies use the same kind of gate and amenity apps, and most have never agreed who answers when one is breached
This post argues that the app a housing society uses to book the gym or let in a visitor is part of the building’s security, and that Indian RWAs and developers should settle, in writing, who is responsible when it is breached. Korea has just shown why. On the night of 28 October, an outsider got into the community-facility booking system that GS Engineering & Construction runs for its Xi apartment complexes.[1]
Nobody’s card number or bank account was taken. What was exposed was quieter and, for a building, more useful to the wrong person: who lives in which flat, who heads each household, when they last logged in and from where, and the RF card numbers registered for the clubhouse.[1][2] Put together, that is a map of the people inside a building.
The Xi breach exposed household details, which residents cannot simply cancel and reissue
The timeline is short. GS E&C says it noticed abnormal access at about 11:29 pm on 28 October, and when it went back through the logs it found the outside access had started at about 10:15 pm.[1] By Friday, 30 October, it had sent notices to affected residents, blocked the external IP addresses, reported the incident to the authorities and asked residents to change their passwords.[2]
The company was quick to say what was not lost. Passwords were stored with one-way encryption, and it never collected resident registration numbers, bank account numbers or card numbers, so those could not leak.[1] That is reassuring as far as it goes. A stolen card can be blocked in a phone call. A home address, a date of birth and the fact that you head your household cannot be reissued. When the first reports came out, the company was still working out which complexes and how many residents were affected.[2][5]
It also matters what this system was connected to. It started life as a booking tool, but it sits inside Xi Home, GS E&C’s resident app, which also links households, handles common-entrance access, registers visitor cars and controls smart home features.[3][4] Yonhap reports that Samsung C&T, Hyundai E&C, Daewoo E&C and DL E&C run similar resident platforms of their own.[3] With apartments making up 65.8 percent of Korean homes, these apps touch a very large share of the country.[5]
GS E&C says the leaked card numbers cannot open doors, and owners should be able to check that kind of claim themselves
One detail is worth slowing down for. GS E&C says the RF card numbers were membership numbers for the community facilities, separate from the numbers that open the common entrance.[3] Security professor Youm Heung-youl of Soonchunhyang University still warned that exposed RF card numbers can be tied to access and so become a physical security problem, not only a privacy one.[3]
Both can be true at once. The company’s reassurance holds only if the two numbering systems never meet anywhere else in the complex, in another database, a spreadsheet at the management office or a lift controller. That is not something residents should have to take on trust. It is the kind of question a building owner ought to be able to answer in an afternoon.
Every field in the Xi notice turns into a question an Indian society can put to its own vendor
To make this practical, we took the fields GS E&C listed as possibly exposed and asked what a society should want to know about the same field in its own app. The first column comes from the company’s notice as reported.[1][2] The other two columns are our own reading, not findings from the Korean investigation.
| Field listed in the Xi notice | Why it matters in a building (our reading) | Question for your society app vendor |
|---|---|---|
| Name, date of birth, phone, email | Enough to make a phishing call sound genuine; GS E&C itself warned residents about smishing and voice phishing [2] | Which of these does the app actually need, and can date of birth be dropped? |
| Home address and residency type | Tells an outsider which flat is owner-occupied or let out | Who on the committee can see residency type, and is that view logged? |
| Head-of-household status | Shows who in each flat holds authority over the account | Is household linking stored with the vendor or only in the society’s records? |
| Last login IP address | Hints at when and where a resident uses the app | How long are login records kept, and who can export them? |
| RF card number | GS E&C says it is an amenity ID, not the door credential [3] | Is the amenity card number ever the same as, or derived from, a door or lift credential? |
| Administrator IDs | Points an attacker at the accounts with the widest access | How many admin accounts exist, and when were they last reviewed? |
| Password (one-way encrypted) | Safe only if hashing is strong and residents do not reuse the password [1] | How are passwords stored, and is two-step login available for admins? |
None of this needs a security consultant. It needs one person on the committee, or at the developer’s facility management desk, to treat the app as a system the building is responsible for, rather than a service it simply pays for.
Indian gate apps hold the same kind of data, and their makers say it belongs to the RWA
Indian gated communities have lived with these apps for close to a decade. ThePrint’s 2025 report from Gurugram describes MyGate, NoBrokerHood and ADDA logging every entry and exit, tracking gym and court bookings, and in some cases recording the biometric data of domestic workers.[6] MyGate told the paper it serves over 25,000 communities and 4 million households.[6]
The same report has a line every RWA should read twice. MyGate’s co-founder and CEO, Abhishek Kumar, said: “we are not the custodians of the data. The data belongs to the RWAs and is stored in AWS cloud servers.”[6] Lawyer Apar Gupta of the Internet Freedom Foundation told ThePrint that, apart from the contract between the app and the society, no enforceable law governed what such apps collect.[6]
In fairness, the vendors do publish real safeguards. MyGate’s privacy page says it holds ISO 27001:2022 certification, deletes visitor entry and exit records every 180 days, hides phone numbers by default on RWA dashboards, and tells a resident when a committee member looks up their visitor.[7] We have not tested those claims. But they are not really the point. If the vendor’s position is that the data belongs to the society, then the society is the one that has to know where the data sits, who can reach it, and what happens on the night something goes wrong.
We wrote about a similar ownership gap for cameras and BMS controllers in Three Advisories, One Gap: Who Patches Cameras and BMS?. The gate app is the same problem, with residents’ personal details attached.
India already has a six-hour breach rule for app companies, and a 72-hour duty arrives in May 2027
India is not starting from zero. CERT-In’s directions of 28 April 2022 require service providers, intermediaries, data centres, body corporates and government organisations to report listed incidents within six hours of noticing them, including data breaches, data leaks and attacks on IoT devices and related systems.[8] The same directions ask them to keep logs of their ICT systems for a rolling 180 days.[8] A company running society platforms is a body corporate. Whether a registered RWA also falls inside these directions is a legal question we won’t try to answer here, which is one more reason to write the reporting duty into the contract.
The bigger change is coming. The Digital Personal Data Protection Rules were notified in November 2025 on an 18-month phased timeline.[9] Once Rule 7 takes effect, whoever is the data fiduciary must tell each affected person about a personal data breach in plain language, inform the Data Protection Board without delay, and send the Board a detailed report within 72 hours.[9][10] On a simple count, that duty begins in May 2027.[10]
Picture how this could play out. This is a made-up scenario, not a real case. A society app in India is breached on a Wednesday night, just as Xi was. The vendor may owe CERT-In a report within six hours. From May 2027, someone must also reach every affected resident and the Board. If the vendor believes the data belongs to the RWA, and the RWA believes the vendor takes care of all that, the first six hours are lost to an argument about whose job it is.
Korea, for all its smart apartments, has the same blind spot. Yonhap notes that its rules focus on separating home networks and inspecting equipment, with no specific standard on what resident data booking and access services may collect, where they keep it or who may see it.[3] India does not need to learn that lesson the hard way. For more on building systems and vendor duties, see Smart Buildings: Navigating the Threat of Cyber Risks and CERT-In OEM Guidelines: Turn ‘Should’ Into Contract Clauses.
Six contract clauses will settle most of the breach questions before the next renewal
The good news is that most of this can be fixed on paper, at the next contract renewal, without new technology.
First, name the data fiduciary and the processor. The agreement should say who decides what is collected and why, and who only handles it. “The data belongs to the RWA” should not stand on its own without the duties that come with it.[6][10]
Second, put the incident call in writing. The vendor should tell the RWA’s named contact within hours of noticing a problem, and file any CERT-In report it owes with a copy to the society.[8] Third, ask for a field list and a retention list: every field the app holds on residents, staff and visitors, how long each is kept and how it is deleted. The table above works as a checklist.[1][7]
Fourth, keep amenity IDs apart from door credentials. Get written confirmation that a card or member number used for bookings cannot open any door, gate or lift, and then check it on site.[3] Fifth, keep admin access small and logged. List everyone with admin rights, from committee members to vendor staff, review the list every quarter, and require access logs to be kept for at least 180 days.[8]
Sixth, agree the resident notice now. Draft the plain-language message residents would receive after a breach, covering what happened, what was exposed, what they should do and whom to call, so it is ready well before May 2027 makes it a legal duty.[9][10]
Planning a command and control centre? Talk to Trisim Global Solutions.
Trisim’s view: a society app is a building system that happens to live in the cloud, so the RWA should own its data map and its breach plan with the same care it gives the fire panel.
Sources
- Seoul Economic Daily, GS E&C Reports Data Breach at Xi Apartment Community System, 30 October 2026
- The Herald Business, GS Engineering & Construction confirms personal data breach at some apartment complexes, 30 October 2026
- Yonhap News Agency, 똑똑해진 아파트, 개인정보 안전할까…건설사 해킹에 보안 우려(종합) (in Korean), 1 November 2026
- JKN, GS E&C Apartment Reservation System Hacked, Renewing Concerns Over Resident Data Security, 1 November 2026
- The Korea Times, GS E&C data breach exposes blind spots in Korea’s smart apartments, 2 November 2026
- ThePrint, Gurugram gate apps know everything. Privacy vs convenience is dividing condos, 21 April 2025
- Mygate, Mygate Data Privacy: Your data, your choice, accessed 5 November 2026
- CERT-In, Directions under sub-section (6) of section 70B of the Information Technology Act, 2000 (PDF), 28 April 2022
- Press Information Bureau, Government notifies DPDP Rules to empower citizens and protect privacy, 14 November 2025
- dpdprules.org (annotated text of the DPDP Rules), Rule 7, DPDP Rules 2025: Intimation of personal data breach, last verified 16 August 2026