South Korean personal data breach trends

South Korea has faced significant challenges regarding personal data security, characterized by large-scale breaches and subsequent regulatory enforcement. In one specific instance, GS Retail was fined approximately 12.8 billion won after a “credential stuffing” attack compromised the data of roughly 1.66 million users across its GS SHOP and GS25 platforms. The Personal Information Protection Commission cited the company’s failure to block large-scale login attempts and its delayed response to the breach.

Broadening the scope, data from the Personal Information Protection Commission reveals that approximately 140 million individual records were leaked in South Korea between September 2020 and July 2024. These incidents were driven by external hacking, professional negligence, system errors, and intentional leaks by employees. Major leaks involved companies such as Coupang and SK Telecom. In response to these widespread vulnerabilities, the commission has levied total fines reaching approximately 1.11 trillion won, with officials calling for a transition toward a “proactive, prevention-oriented supervisory system.”