According to South Korean media reports, despite managing sensitive data of millions of users, Korean funeral companies are not subject to information security regulations, raising concerns about data protection and the risk of ransomware attacks.

According to the data of Korea Internet Promotion Agency, by the end of 2025, the number of subscribers of funeral products managed by the top five funeral companies in South Korea has reached nearly 10 million, and the scale of prepayment has reached 10 trillion won. Due to the fact that funeral companies are not classified as information and communication service providers, even with a large user base, they do not need to fulfill information security management obligations. Experts criticize the industry as a "regulatory blind spot" and call for the application of the same information security regulations for the funeral industry as for the financial, shopping, and platform industries.

Core Findings

Regulatory blind spot: As funeral companies are not classified as "information and communication service providers", even with a large user base, they do not need to fulfill information security management obligations, such as obtaining government information security management system certification.

Lack of certification: As of the end of 2025, most of the top five funeral companies in South Korea (Woongjin Freelife, Kyowon Life, Boram Sangjo Development, The K Yedaham, and Sonostation) have not obtained any government information security certification. However, subsequent reports have shown that Sonostation has voluntarily obtained the highest level of information security and personal information protection management system certification, becoming an exception among the five major companies.

A security incident has occurred: In January 2026, Kyowon Group (which operates funeral services) suffered a ransomware attack that could have affected 9.6 million user accounts. The government investigation team estimates that 600 of the company's 800 servers are within the scope of the leak, but the company has not yet confirmed whether user data was actually leaked.