South Korea fines Kakao $11.1 million for data leak

Kakao, the parent company of South Korea’s most widely used messaging app, KakaoTalk, has been fined KRW 15.1 billion (approximately $11.1 million) by the Personal Information Protection Commission (PIPC) following a significant data leak. This fine marks the largest privacy penalty ever imposed in South Korea, surpassing the previous record of KRW 7.5 billion levied against Golfzon earlier this month.

The investigation into Kakao’s data security practices began in March 2023 when KakaoTalk user data was found for sale on a cybercrime-focused Telegram channel. PIPC’s investigation revealed that hackers exploited a lack of encryption on user ID numbers, granting them unauthorized access to approximately 65,700 user IDs. Although the breach appeared limited to these identification numbers, the commission cited Kakao’s inadequate monitoring and slow response as contributing factors.

Kakao defended its actions, asserting that it promptly reported the incident to the PIPC and local police. The company also claimed it provided detailed explanations of the leak, which it insists went ignored. However, the PIPC determined that Kakao’s security measures were insufficient, warranting a substantial fine.

KakaoTalk, which emphasizes user anonymity, identifies users by unique serial numbers rather than personal details. Despite this, the breach’s implications were considered severe, similar to the controversy in March when GlassDoor mistakenly exposed users’ full names and personal details publicly.

This hefty fine and other recent penalties fall under the revised Personal Information Protection Act (PIPA), which has introduced stricter regulations since September 2023. PIPA amendments now include rights for data subjects to request explanations of decisions made by automated systems and impose transparency requirements on data processors.