Information Security, Including Personal Information Protection

Ⅰ. Corporate Governance

Decision-Making Structure

Hanmi Science operates an Information Security Committee for systematic and effective information protection activities. The CEO is designated as the Chairperson of the Information Security Committee, reviewing and deciding on major agenda items related to information security and personal information protection. When important issues arise, Information Security Committee meetings are held weekly. As cases of cyber terrorism, personal information leakage, and hacking targeting pharmaceutical and bio-companies have continuously increased recently, the Information Security Committee is actively implementing a systematic and independent information protection management system to proactively respond to these threats. In particular, to respond swiftly to information security breaches, a reporting system and disciplinary regulations for violations have been established. By reviewing and determining response measures and punishment levels according to the severity of the violation, the committee systematically addresses infringement incidents. Furthermore, in preparation for increasing cyber threats, regular simulated hacking and vulnerability assessments are continuously performed, thereby identifying potential security vulnerabilities that may occur during information system and personal information processing in advance and implementing corrective actions. The inspection results are shared with relevant departments to establish recurrence prevention measures and continuously enhance the level of information protection. To date, there have been no personal information leakage incidents or security breaches, and continuous management and improvement efforts will be made to prevent future security incidents. To effectively carry out information security and personal information protection activities, the company maintains close cooperative relationships with external expert groups to secure specialized information and capabilities, including information security threat trends and related control measures. Additionally, an Information Security Steering Committee is operated to review and decide on matters concerning the planning, execution, evaluation, and improvement of (personal) information protection tasks. Members of the Information Security Committee, including the CISO, enhance mutual communication and cooperation through weekly security meetings. Regular training will also be conducted to strengthen the expertise of the responsible executives in the future.

Information Security Committee

Personal Information Protection Operating Organization

Roles and Responsibilities

Ⅱ. Strategy_Risk and Opportunity Identification

Based on the results of the IRO analysis, Hanmi Science is identifying key risks and opportunities related to information security, including personal information protection, that could significantly impact stakeholders and sustainability, and is continuously striving to develop effective response measures.

Ⅱ. Strategy_Risk and Opportunity Response Plan

Establishment of an international standard information security management system

Strengthening information protection regulations/guidelines and personal information processing policy

Hanmi Science, based on the management's firm commitment to information protection, completely enacted and revised 5 types of information security regulations and 8 types of guidelines in 2025 to ensure the confidentiality, integrity, and availability of all data generated and processed by the company. In particular, as the company-wide work environment transitioned to Microsoft 365 (M365), we reorganized the overall information protection standards, including access control, account management, data protection, and log management, to align with the M365 environment, reflecting the characteristics of the cloud environment and collaboration systems. All information protection related documents, including these information protection regulations and guidelines, personal information processing policy, and internal personal information management plan, are established and operated reflecting revisions to the Personal Information Protection Act and internal operational status, and are kept up-to-date through periodic reviews and revisions in accordance with changes in relevant laws and regulations and the environment. In addition, Hanmi Science continuously updates its personal information processing policy whenever there are changes to the Personal Information Protection Act or issues requiring changes within the policy, and makes it public through the main website so that employees and data subjects can easily check it. Hanmi Science's personal information processing policy and the Information Protection Declaration, which confirms the management's commitment to information protection, can be found via the link above.

Establishment of an integrated protection system focused on personal information leakage response and prevention

Hanmi Science carries out various activities, including thorough pre- and post-measures, for personal information protection. In preparation for potential customer personal information leaks, we establish relevant regulations and guidelines, set up a system for rapid response in case of an incident, and also subscribe to personal information protection liability insurance to prepare for additional risks. Furthermore, in the event of a personal information leakage incident, we have prepared a personal information leakage response manual to prevent further damage and ensure rapid recovery. According to this manual, upon an incident, we immediately identify the cause, take measures to prevent further leakage, notify affected parties, and report to relevant authorities. In particular, the Personal Information Protection Officer reports the incident to the CEO, forms a rapid response team for personal information leakage to systematically address it, and also prepares relief measures for victims and recurrence prevention strategies. In conjunction, we collaborate with the Personal Information Protection Commission to deliberate and determine response measures and punishment levels according to the severity of the incident, and implement regular security training and internal management plans to prevent security breaches. Moreover, major service platforms that process customer personal information and provide payment functions are regularly checked through mock hacking, and any vulnerabilities identified are immediately addressed to improve weak points. Furthermore, all websites publicly launched by Hanmi Science undergo a pre-launch security review process, conduct mock hacking, address 100% of all discovered vulnerabilities, complete implementation verification, and finally operate under a system approved by the CISO before launch.

Personal Information Protection Breach Reporting/Response Process

Education to raise awareness of personal information for personal information handlers

Hanmi Group conducted personal information protection awareness-raising education for all employees, reflecting the revised Personal Information Protection Act of 2025. In particular, it was developed with a practical focus to enable employees who handle personal information to learn more carefully.
The training content was structured around common mistakes during personal information processing and frequent violations during personal information collection, and realistically guided on how to respond quickly and appropriately when personal information leakage occurs. Furthermore, to prevent indiscriminate processing when entrusting or sharing personal information, personal information handlers were educated to clearly recognize their legal and ethical responsibilities and to thoroughly comply with safe processing procedures.
This supported employees in establishing a safe personal information management culture and preventing legal risks. Hanmi Pharmaceutical plans to continuously expand customized training to strengthen practical capabilities related to personal information protection in the future.

Hanmi Group Personal Information Awareness Training Materials

Security awareness campaign to prevent personal information leakage and security incidents

Hanmi Science conducts various participatory campaigns to strengthen employees' information protection awareness and create a secure work environment. In particular, in 2025, we conducted a password prevention campaign to prevent Credential Stuffing attacks, guiding employees to practice safe password management habits. Additionally, we operated quiz-format content to allow employees to naturally check personal information and information protection regulations frequently encountered in their work, providing an opportunity for them to directly read and understand the regulations. This campaign was structured around actual security incident cases and prevention methods, raising employees' awareness and supporting them in naturally applying security rules in their daily work. Furthermore, during periods when security incidents are more likely, such as vacation seasons or holidays, we produce and distribute posters containing practical information protection rules, including precautions for external access, device loss prevention, and personal information handling guidelines, to help employees recognize security once again in their daily lives. Hanmi Science plans to continuously develop an employee participation-centered information protection culture in the future.

Personal Information Protection Day Password Change Campaign	Information Leakage Prevention Poster	Information Leakage Prevention Poster

III. Risk Management

Ⅳ. Indicators and Goals