Dior faces potential ₩30 million fine in South Korea over unreported data breach

Luxury fashion house Dior may be fined up to 30 million won for failing to report a significant data security incident involving South Korean customers.

In a data security incident notice, Dior said that on May 7, it identified a network intrusion where unauthorised third-party breached the company’s internal network and stole customer data.

In a notification sent to affected customers, the compromised data included names, gender, phone numbers, email addresses, mailing addresses, purchase amounts, and shopping preferences. Dior assured customers that the threat actors did not access financial details such as bank account numbers, IBANs, or credit card information.

A data security incident notice was posted on Dior’s South Korean website too confirming that the company is actively investigating the incident. 

While Dior reported the incident to the Personal Information Protection Committee in Korea, it failed to notify the Korea Internet & Security Agency (KISA), which holds a critical role in handling cybersecurity and data protection incidents.

Under Korean law, companies that experience a data breach impacting residents must report the incident to either the Ministry of Science and ICT or KISA. As outlined in Article 48, Paragraph 3 of the Information and Communications Network Act, failure to comply could result in a fine of up to 30 million won (approximately £16,000), should the Ministry of Science pursue formal charges.

In a statement shared with the media, a spokesperson from the office of Rep. Choi Soo-jin of the People Power Party said, “Considering that SK Telecom also reported its hacking incident late -- two days after it happened -- and Dior only reported the breach to the PIPC and not to KISA, it can be interpreted that the industry has not been given sufficient notice regarding the reporting work of the agency.”