Duzon BizOn Ruled “Major”: How Should ERP Supply Chain Risks Be Managed?

The Ministry of Science and ICT (MSIT) has classified Dozon Biz-On's cyber intrusion as a 'major incident' and begun forming a public-private joint investigation team ¹. As of October 26, 2026, while the investigation is ongoing, this incident brings into sharp focus 'supply chain security,' a chronic weakness in domestic IT infrastructure, going beyond a mere security breach at a specific company ².

We will examine the gravity implied by the term 'major incident,' along with the core issues of the situation: vulnerabilities in the backup solution and the limitations of data encryption. Although the extent of the damage has not yet been confirmed, considering the nature of the ERP system and its market share, the potential risks facing companies are far from negligible. This article analyzes the confirmed circumstances and impact of the incident to date, objectively compares alternative security defense strategies for businesses (such as network segmentation, cloud backup, and supply chain management processes), and offers actionable recommendations.

Development of the Dozon Biz-On Intrusion and the Significance of the 'Major Incident' Classification

This incident began when Dozon Biz-On reported the intrusion to the MSIT in two separate notifications on October 16 and 21 ¹. Upon receiving the reports, the MSIT and the Korea Internet & Security Agency (KISA) immediately requested the preservation of relevant data and conducted initial investigations ¹. Subsequently, on October 23, Dozon Biz-On announced via a notice on its website that it had confirmed some encrypted data on its servers had been exfiltrated externally due to a security vulnerability in the product of its backup solution vendor, Ahsay ².

An emergency deliberation committee for intrusion investigation was then convened on October 25, and the committee determined that the incident qualified as a 'major incident' ². Accordingly, the MSIT officially launched a public-private joint investigation team on October 26, led by the Director-General of the Information Protection and Network Policy Division and comprising government agencies and private sector experts ¹.

The deliberation committee, consisting of government and private experts, classified this as a major incident because it represents an epicenter of 'supply chain risk,' where a security breach at a specific ERP vendor can cascade to potentially tens of thousands of client companies using the system, and because it is the first case of a major incident determination under the revised Information and Communications Network Act, which took effect on October 1 ².

Security Gaps in Backup Servers: The Realization of Supply Chain Risks

The core of the incident identified by Dozon Biz-On lies in the security vulnerability of the external backup solution 'Ahsay' ². Many companies adopt external solutions to back up data separately from their main systems, but in this case, the backup server became an easily penetrated bypass for attacks ². Analysis indicates that the attacker exploited the vulnerability in the Ahsay solution to access the backup server and exfiltrate some data externally ².

Such 'supply chain risks' are one of the most significant concerns in modern cybersecurity. While companies invest heavily in resources and personnel to secure their own main servers, they often overlook security flaws implanted in the numerous external software and vendor solutions (such as backups and integrated management programs) that constitute their internal IT ecosystem ².

The table below was prepared to compare general backup solution attacks (the Dozon Biz-On case) with traditional perimeter breaches. The original source (S15) does not explicitly state that 'the extent of damage spread from a main server attack is limited to endpoint-centric effects,' but this comparison was drawn in contrast to the explanation in S15 that backup servers consolidate data from all client companies. However, as these are comparative items not specified in the original text, it is necessary to clarify that this is a 'comparison from a general perspective' or to refine the supporting evidence.

Since backup solutions are the final convergence point for data, a vulnerability breach here can cause the most fatal outcome from a single incident—the simultaneous exposure of all client companies' data ². This demonstrates how devastating bypass attacks through security vulnerabilities in external solutions can be.

Can 'Data Encryption' Mitigate the Scale of Damage?

The fact that attackers exfiltrated data does not immediately confirm actual damage ². The critical defense shield here is 'data encryption.' Dozon Biz-On claimed via its website that the data was encrypted and no evidence of encryption key leakage had been found ².

If the data is strongly encrypted and the 'encryption key' needed to decrypt it has not been leaked, attackers cannot cause actual exposure of personal information or theft of trade secrets, even if they exfiltrate the data itself ². Conversely, if the data was encrypted but the key also escaped externally, or if the key management system was vulnerable, the shield of encryption is immediately rendered ineffective ².

Currently, the public-private joint investigation team is precisely investigating the hacking pathway, the actual scope of data leakage, and the security status of the encryption keys ². As the specific number of affected client companies and whether personal information was leaked remain unconfirmed, one must refrain from prejudging the outcome ².

This ambiguity in the encryption status causes significant operational confusion for companies. If the data remains safe, the issue may end with security enhancements; however, if the exfiltrated data was in unencrypted plaintext or if the key was also exposed, it could lead to fatal cost burdens such as subsequent legal liabilities and customer compensation ².

Alternative Defense Strategy 1: Physical/Logical Network Segmentation (Strengthening Backup Architecture)

To prevent attacks targeting vulnerabilities in external backup solutions, as seen in the Dozon Biz-On incident, businesses and IT service providers must compare and review various backup strategies. The first alternative is architecture enhancement premised on 'physical/logical network segmentation.'

This strategy involves designing the backup server's network path as an independent or difficult-to-access logical segment (network segmentation), rather than linking the main server (ERP) and the backup server in a single network, thereby ensuring that even if an attacker accesses the main server, the backup server remains protected. (※ Note: The provided original texts S3 and S15 do not mention specific 'network segmentation' technical measures; therefore, this should be explicitly stated as a general security response measure, or the citation reference should be excluded.)

• Advantages: By establishing a separate security layer for the backup server, it can help block horizontal movement (sideways) exploits of external solution vulnerabilities and facilitate the detection of data exfiltration attempts.
• Disadvantages: It requires complex network configurations for synchronization between backup servers, leading to a sharp increase in management costs and system complexity. This may constitute an excessive investment for companies with small-scale IT infrastructures. (※ General alternative description not found in the original text)

Alternative Defense Strategy 2: Transition to Third-Party Offsite/Cloud Backup

The second alternative is to reduce reliance on on-premises (self-hosted) backup solutions and transition to verified third-party offsite (remote) backups or professional cloud backup services.

• Advantages: Companies can leverage the sophisticated security infrastructure and regular vulnerability analyses of professional backup service providers. Storing data in a center located in a physically different region from the main system ensures independence from on-premises network breach incidents.
• Disadvantages: There may be 'external dependency' issues requiring trust in the security policies of external cloud vendors. One must also consider the possibility of supply chain risks within the cloud vendor itself or security incidents during data transmission. (※ General alternative description not found in the original text)

Alternative Defense Strategy 3: Strengthening Strict Data Encryption and Key Management (KMS)

The third alternative is to significantly enhance the data encryption and encryption key management systems without changing the backup architecture. This is because Dozon Biz-On's emphasis on 'maintaining data encryption status' could be the key to minimizing actual damage ².

• Advantages: This approach allows companies to raise data protection levels without modifying existing backup infrastructure. Even if data is exfiltrated (stolen), substantial data leakage damage can be minimized through strong encryption and secure key storage (KMS).
• Disadvantages: If an attacker infiltrates the key management server itself and simultaneously steals the encryption keys, the effectiveness of encryption can be completely nullified. Additionally, system load may occur during the encryption-decryption processes. (※ General alternative description not found in the original text)

Conclusion and Actionable Recommendations: Can Unverifiable Encryption Be Trusted?

The classification of Dozon Biz-On's incident as a 'major incident' clearly illustrates the threat of backup solution vulnerabilities spreading across the entire supply chain ¹, ². Until the final investigation results of the public-private joint investigation team are announced, companies must treat this period of uncertainty as an exercise in 'managing risk' ².

When comparing various alternatives, there is no single correct answer for a specific backup architecture. However, we present a combined recommendation reflecting the lessons from this incident.

1. Separation of Network Segmentation and Encryption Keys (KMS): On-premises backup servers should be logically completely separated from the main system, and encryption keys should be stored in a separate cloud KMS outside the on-premises environment or on physically secure offline media to fundamentally block scenarios where data and keys are leaked simultaneously.
2. Mandatory Regular Verification of External Backup Solution Vulnerabilities: Internal IT processes must be established to enforce regular checks on patch status and security vulnerability diagnostics for external vendor backup solutions linked to ERPs or groupware.

As the MSIT has stated it will transparently disclose the investigation results, response protocols need to be updated immediately once the confirmed scale of damage and technical analysis results are released ¹. Companies and employees must also take precautionary measures to prevent secondary damage, such as being wary of emails or smishing messages from unknown sources and immediately changing passwords for administrator and linked accounts ².