CJ Group filed a complaint with the Seoul Metropolitan Police Agency on May 19 after a Telegram channel posted the mobile phone numbers, job titles, internal phone numbers and photographs of around 330 female employees, the company said on May 20.

The company said it acted after what it described as a violation of the Personal Information Protection Act and would cooperate fully with investigators. A CJ Group representative said the firm had individually notified the affected employees and was taking steps to prevent secondary damage.

The leak spread through a Telegram channel that was created in 2023 and reportedly has about 2,800 members. The post circulated on May 18, making the case a live privacy crisis for the conglomerate by the time the company confirmed its complaint the following day.

What makes the episode more troubling is that some of the exposed information was said to be available through CJ Group's internal intranet. That detail has pushed suspicion toward an insider rather than an outside hacker, according to industry experts, although the source of the leak has not been confirmed.

South Korean law requires reporting to the Personal Information Protection Commission in certain large-scale breaches or leaks involving uniquely identifiable or sensitive information, but it has not yet been confirmed whether the material posted in this case meets that threshold. For CJ Group, the immediate task is no longer just tracing the leak. It is limiting the damage to employees whose private details were pushed into a public channel and figuring out how such information left the company in the first place.