[Tech Espionage] ③ “Lured by a Sweet Job Offer…” How Internal Audits Saved HKMG and CIS Blueprints

[비즈한국] Technology often leaves a country quietly, tucked away in someone’s bag on their way home from work. Research outcomes and national strategic technologies accumulated over decades vanish, captured on a few printed pages or a USB stick. While dozens of technology leak cases are uncovered every year, the full picture is rarely seen. Through a four-part series titled ‘Tech Espionage,’ Bizhankook reconstructs the moments of these leaks based on real-life cases.

Part 1: ‘The Golden Ticket’

Before the ink had even dried, the bag was shut

December 2022, Shanghai, China.

Amidst the festive year-end atmosphere, Team Leader Wang Xiao faced a cold reality. Her name was missing from the internal promotion list. It did not take long for the pride she had built over nine years at a leading global memory semiconductor company in Korea to turn into a sense of betrayal.

Her plan to move to Zhonghua Hi (Huawei) became increasingly clear. As China's largest telecommunications equipment manufacturer, Zhonghua Hi needed talent experienced in advanced technologies and processes to close the technological gap. Team Leader Wang had been in charge of semiconductor failure analysis at the Korean headquarters before moving to a managerial role at the Shanghai branch's client consulting office two years prior. The offer from Zhonghua Hi was extraordinary: “An annual salary of 1.6 million yuan (approx. 320 million KRW) before tax for the first year, with separate housing support.” It was four times her current base salary.

In a WeChat message sent to her mother the following spring, her expectations for a new life were revealed without filter: “Mom, I’ve decided to go to Zhonghua Hi. I’m returning to China in August.”

Having reached a management position in her 30s, she saw this as the opportunity of a lifetime to open the second chapter of her career.

Once the job change was finalized, Team Leader Wang acted swiftly. In late June, just before her planned return to the Korean headquarters, the mechanical hum of a printer shattered the silence of the Shanghai office. She printed a total of 1,309 documents, a massive volume amounting to about 4,000 pages. Within them were the HKMG (High-K Metal Gate) design specifications—a core process for preventing leakage current in DRAM—and the corresponding evaluation results.

Team Leader Wang began bringing a large shopping bag to work in addition to her usual backpack. Unlike the headquarters, the Shanghai office lacked security checkpoints, making theft easy. Every day between 5 PM and 7 PM, right after printing the massive documents, she would slide them into her shopping bag and leisurely walk out of the office.

Headquarters in Icheon.

As the unusually hot summer began and her resignation was formalized in mid-July, the security team, having detected suspicious signs, took action. Team Leader Wang sat face-to-face with Team Leader Choi of the Industrial Security Team. It was a session to account for the anomalies detected by the security system. She remained calm.

“I printed them for study purposes because there were many client inquiries, and I shredded them all on the spot. I only responded to the job offer to see what my market value was.”

Team Leader Wang pleaded her innocence. She admitted to printing the materials but denied any intent to leak technology. When pressed about the specific dates where suspicious activity was recorded, she fluently recited her daily schedule, claiming she was at her farewell party on those days and left work with colleagues on the last day, making any leak impossible.

However, when the security team checked the Shanghai office, the thousands of shredded paper scraps she claimed to have destroyed were nowhere to be found.

Three days later, well past noon on a Monday, she left a short message for her team leader saying, “I’m not feeling well, I’ll take a leave,” and headed straight to Incheon International Airport. It was still a bright mid-summer evening. It was a desperate flight back to her home country, China.

A week later, her husband also packed up their apartment in Icheon and began erasing all traces of their life in Korea.

Upon returning to her home country, Wang Xiao began working at Zhonghua Hi Group. As time passed, the incident seemed to be fading. A year later, she felt relieved after a former colleague told her, “All legal actions have been dropped.” Shortly after, she set off on a trip to the blooming island of Jeju.

What awaited her was not the blue sea, but an arrest warrant from the prosecution. As she entered Jeju Airport with a light heart for her family vacation, cold handcuffs were snapped onto her wrists. Her 21-month escape had come to an end.

Part 2: The Night in Shanghai

The shutter closed, and the technology crossed the border

Team Leader Park had fallen into a rut. When the company acquired the CIS (CMOS Image Sensor) technology of its subsidiary, Team Leader Park, who belonged to the subsidiary, saw his position change. That was already six years ago. It had been over four years since Team Leader Park was dispatched to the Shanghai sales corporation in China. His role was to explain the company's leading global memory technology in the Chinese market.

However, even the dazzling night view no longer stirred him. He had no reason to turn down the offer from his old colleague, Kang Seok-jun, to join Hwa-Silicon, a CIS design company and subsidiary of Zhonghua Hi. An explanation followed that they were preparing to expand their memory business. Team Leader Park decided to switch jobs. To him, CIS design technology was no longer a secret worth keeping.

February 2022. The job move was finalized. Team Leader Park moved quietly. In the evenings, after employees had left, the printer began to run, breaking the silence of the Shanghai office. Over fifteen days, across eight occasions, 186 core documents were placed in his bag.

The laptop he had brought home under the guise of working remotely was now his most faithful accomplice. Holding his breath, he picked up his iPad. Shadows fell over the CIS process blueprints filling the screen.

Click.

He turned the page and pressed the shutter again. Pixel structures, wafer test items, noise analysis data... The persistent collection continued until summer. From the basic principles of CIS operation to the blueprints, internal training materials, technology to prevent inter-pixel interference, AI semiconductor hybrid bonding technology, post-processing techniques, and business strategy documents—the photos taken over five months amounted to 5,900 pages.

Team Leader Park hid these materials under the guise of an “employment resume.” In the lines of the resume file he delivered to the HR manager, the company's technology was masqueraded as Team Leader Park's personal achievements.

The moment the email with the attached resume crossed the border, he had crossed a point of no return. In August, the same blueprints were handed over to another competitor, Qingdao Semiconductor.

Abnormally surging document access records. Even his seemingly perfect timeline left a trail.

Part 3

Two resumes on the scales of justice

1. Overturned sentencing, the weight of national core technology

Team Leader Wang Xiao, who went to China, grew complacent after no judicial measures were taken for two years and planned a family trip to Jeju Island. Arriving at Jeju Airport in April 2024, she was arrested by police who had been investigating based on company intelligence and was sent to trial under detention.

Team Leader Wang’s arguments were put to an end by the Supreme Court. In August 2025, the Supreme Court confirmed the original verdict, sentencing her to five years in prison and a fine of 30 million KRW for violations including the Industrial Technology Protection Act. The 1 year and 6 months sentence given in the first trial was significantly increased to 5 years in the appellate court and was upheld.

The court clarified that the leaked HKMG technology has been designated as a “National Core Technology” for national security since 2016. It judged that her act of intensively printing and taking out 4,000 pages of material from the poorly secured Shanghai office at the time of her confirmed job move was a very grave crime. In particular, her attitude of denying the crime without remorse and the immense harm to the national economy if this technology were leaked overseas became the decisive grounds for the increased sentence.

2. Unauthorized photos attached to a resume

In January last year, the prosecution secured evidence of industrial technology leaks by raiding the residence of Team Leader Park Jin-woo. In October of the same year, the Seoul Central District Court sentenced him to 1 year and 6 months. Park was found guilty of using the security vacuum at the Shanghai office to photograph approximately 5,900 pages of technical data and leaking them by citing them in resumes for competitors.

However, the charge of violating the Industrial Technology Protection Act, which had prosecuted hybrid bonding technology as advanced technology, was acquitted. The expert committee's opinion was accepted that this technology is a separate technical path with different physical principles from the “TSV-based process” specified by law. The court considered the defendant's lack of prior criminal record, his admission of guilt, and the fact that the leaked materials were not at a level directly linked to the actual manufacturing process when determining the sentence.

This factional article reconstructs two parallel cases from 2022 where SK Hynix employees in Shanghai, China, unauthorizedly removed the company's core technical data. Chinese researcher Defendant A (pseudonym Wang Xiao) and Korean expatriate Defendant B (pseudonym Park Jin-woo) were accused of leaking SK Hynix’s industrial technology data to move to Huawei.

Defendant A decided to move to the Huawei Group with an annual salary of approximately 320 million KRW after being passed over for promotion, and printed 4,000 pages of HKMG technical data. Defendant B photographed CIS technical data and used it in his resume for the job change, delivering it to Huawei. The leaked materials that B photographed without authorization amounted to approximately 5,900 pages. The prosecution also confirmed that the resume sent by B was actually delivered to executives and the CEO of another Chinese competitor. In this process, markings like “Confidential” or the SK Hynix logo were deleted.

SK Hynix, a company holding national core technology, focuses on preventing technology leaks through its electronic security system and industrial security department monitoring. Through constant monitoring, if abnormal signs such as an unexpected increase in printing volume by an employee scheduled to retire or document access logs are detected, an internal investigation is immediately launched. In particular, it responds to attempts using the physical security vulnerabilities of overseas branches like Shanghai through electronic log tracking, and if circumstances of a leak are confirmed, it immediately requests an investigation and takes legal action.

SK Hynix explained, “We prohibit the use of storage media such as USBs for security reasons, and for printed materials, we manage them by recording the content, the person who printed them, and their place of use in detail,” adding, “We are making security management improvements by strengthening CCTV and monitoring systems.” These cases also had their full picture revealed through the company's internal audits and requests for investigation.

The judiciary applied strict standards to the actions of researchers dealing with semiconductor technology, the foundation of national competitiveness, who betrayed that trust. It confirmed a heavy sentence of 5 years in prison and a 30 million KRW fine for Defendant A, warning of the harm that technology leaks pose to national security. In the case of Defendant B, a 1-year and 6-month sentence was given, taking into account whether some technologies legally qualified as “advanced technology” and how directly the data was linked to actual manufacturing.