South Korea data breaches reach 140 million records over six years

Approximately 140 million pieces of personal information have been leaked in South Korea over a nearly six-year period, according to data from the Personal Information Protection Commission. Between September 2020 and July 2024, 641 confirmed data breach incidents resulted in the exposure of 139,637,474 individual records.

The primary causes of these leaks were external hacking (276 cases) and professional negligence (275 cases), followed by system errors and intentional leaks by employees. Major recent incidents involved large-scale exposures from companies such as Coupang, which leaked over 33 million records, and SK Telecom, which leaked over 31 million records.

In response to these breaches, the Personal Information Protection Commission has issued significant financial penalties. Total fines imposed since the commission's inception have reached approximately 1.11 trillion won, with a record 624.6 billion won fine levied against Coupang in June for leaking 37.5 million records and unauthorized data collection. Representative Park Seong-hun has called for a shift from reactive, penalty-based enforcement to a proactive, prevention-oriented supervisory system targeting high-risk platforms.