South Korea

The PIPC imposed a KRW 630 million surcharge and a corrective order after a SQL injection flaw on the hospital website exposed IDs, passwords and personal details of 188,481 members in March 2024. No web firewall was run, vulnerability checks were missing, and an insecure password hashing method without salt values was used.

The PIPC fined Daekyo KRW 3.255 billion and issued corrective and disclosure orders after hackers used a web shell on an affiliate site to take about 650,000 records. It found unnecessary direct access from the affiliate server to the member database, monitoring alerts left unanswered in August 2024 before a repeat in February 2025, and weak oversight by the Chief Privacy Officer.

At its 18th meeting the FSC imposed a KRW 937.8 million surcharge for financial statements prepared in breach of accounting standards, and KRW 362.1 million on the CEO and three others, not named. Auditor designation had been decided separately by the Securities and Futures Commission on 16 September 2026.

The FSC imposed a KRW 80 million surcharge on the audit firm for not performing adequate audit procedures on Ascendio and its management.

The FSC imposed a KRW 733.7 million surcharge for financial statements prepared in breach of accounting standards, and KRW 157.9 million combined on three people led by the former joint administrator, not named.

At its 17th meeting the FSC imposed a KRW 7,633.0 million surcharge for financial statements prepared and disclosed in breach of accounting standards, with KRW 1,521.9 million on the CEO and five others, who are not named. The same release sanctions Ascendio and two audit firms.

The FSC cancelled the firm's investment advisory and discretionary investment registrations after an FSS inspection found it was not carrying on the registered business, had breached minimum capital rules and had filed false business reports. It also imposed a KRW 1,280 million administrative fine for the false reports and sent notices equivalent to dismissal requests on current and former executives, who are not named.

At its 16th meeting the FSC cancelled the firm's authorisation for public collective investment and its registration for general private collective investment. The FSS inspection found it was not carrying on the licensed business, had breached minimum capital rules and had filed false business reports. The FSC also imposed a KRW 1,494 million administrative fine for false business reports and failures to disclose or report major management matters, and a KRW 20 million surcharge for exceeding the limit on credit to its large shareholder (recorded together), and sent a notice equivalent to a dismissal request on a former executive.

The FSC imposed a KRW 946.3 million surcharge for financial statements prepared in breach of accounting standards, with KRW 167.3 million on the former CEO and one other person, not named; the release gives one combined figure for the two.

Credential-stuffing attacks on the GS SHOP and GS25 sites exposed data of about 1.66 million people. The PIPC imposed a surcharge of KRW 12.836 billion and a fine of KRW 3 million, and ordered correction and public disclosure; 1,599 further persons were notified more than 72 hours late. The decision was taken at the 26 August plenary and announced on 31 August 2026.

The PIPC imposed a KRW 73.5 million surcharge because an internal work system holding data on 9,503 employees and subcontractor staff could be reached from another company's server without access restrictions. The same release fined HD Korea Shipbuilding & Offshore Engineering (HD한국조선해양), whose server was the route used, KRW 4.8 million; that fine is not recorded as a separate row.

The FSC imposed a KRW 114 million surcharge on the audit firm for inadequate audit procedures in the Manho Steel case.

The FSC imposed a KRW 380.3 million surcharge for financial statements prepared in breach of accounting standards. Its auditor Daeju Accounting was fined KRW 19.8 million in the same release.

The FSC imposed a KRW 616.1 million surcharge for financial statements prepared in breach of accounting standards, and KRW 123.2 million on the former CEO and one other executive, not named. Its auditor Shinhan Accounting was fined separately.

After a hack exposing credit information of about 2.97 million customers, the FSC suspended Lotte Card's business for 1.5 months (1 August to 15 September 2026) and imposed a KRW 5 billion surcharge. The release describes it as the first business suspension for a hacking incident and cites unpatched systems and unencrypted resident registration numbers and passwords.

A hacker copied a certificate from a lost KT femtocell, installed it in a homemade femtocell and stayed in KT's network for about 11 months, exposing data of 16,647 people. The PIPC imposed a KRW 53.979 billion surcharge, a corrective order and a publication order, and recommended extending ISMS-P certification to the mobile network. It also filed a criminal complaint against KT for failing to report a 2024 malware infection, deleting logs, submitting false data and obstructing the investigation. Decided at the 29 July plenary and announced on 30 July 2026.

The PIPC found that TikTok collected users' activity data from third-party sites through its Pixel, Events SDK and Events API without clear disclosure, bundled it with mandatory consent, and transferred data to an affiliate without required notice. It imposed a surcharge of about KRW 10.306 billion, a corrective order and a publication order. Apple's subsidiaries were sanctioned in the same release.

The FSC imposed a KRW 208.5 million surcharge for financial statements prepared in breach of accounting standards, and KRW 41.6 million on its former CEO and one other, not named.

The FSC imposed a KRW 313.9 million surcharge for financial statements prepared in breach of accounting standards, and KRW 31.9 million on the CEO and one other, not named.

The FSC imposed a KRW 1,068 million surcharge on the audit firm for inadequate audit procedures; the release lists it under Young Poong. The release gives no article numbers.

The FSC imposed a KRW 8,428.1 million surcharge for financial statements prepared in breach of accounting standards. KRW 763.2 million more was set on the CEO and one other person, who are not named.

At its 13th meeting the FSC imposed a KRW 20,474.1 million surcharge on Young Poong for preparing and disclosing financial statements in breach of accounting standards. A further KRW 1,511.5 million fell on its former CEO and three others, who are not named. Auditor designation and other measures had been decided earlier by the Securities and Futures Commission.

The PIPC imposed a KRW 168 million surcharge and a public disclosure order after an administrator page was reachable from outside without IP restriction, login used only an ID and password, and access logs were poorly managed. Data of 1,852 users of an inquiry board was leaked and posted on Telegram.

The PIPC imposed a KRW 503 million surcharge and a KRW 5.4 million fine (recorded together) after two 2024 breaches exposed about 1.3 million customer records. It cited undetected abnormal traffic, a 2022 vulnerability left unpatched, a shared administrator password and unencrypted unique identifiers, and ordered public disclosure.

The PIPC imposed a surcharge the release states as KRW 210 million (2.1억원, a rounded figure) for overseas transfers of personal data without proper consent: member numbers and order data sent to another exchange for USDT order-book sharing in late 2025, and sender and recipient details sent to 13 overseas exchanges for anti-money-laundering purposes. It ordered Bithumb to obtain consent and state the transfers in its privacy policy. This is separate from the FIU fine on Bithumb already in the base file.

The FSC imposed a KRW 815.8 million surcharge for financial statements prepared in breach of accounting standards, and KRW 103 million on the former CEO and one other, not named; a footnote says KRW 16 million of that, on one person, had already been set by the Securities and Futures Commission on 6 May 2026. The same release covers The Technology Co. (formerly Hanchang Biotech).

The PIPC imposed a KRW 248 million surcharge on CFS for using the personal information of 71 journalists without a legal basis by placing them on a hiring-restriction list, and for handling an employee's sensitive weight data in a court case. The decision was announced in the same release as the Coupang sanction, and the date is the release date.

The PIPC fined Coupang a KRW 624.681 billion surcharge plus a KRW 16.8 million administrative fine, so the amount recorded is the sum of the two. It found weak key and access management behind a leak affecting about 37.55 million people, personal data collected without a legal basis, and failings on breach notification, data destruction and Chief Privacy Officer independence. The page gives no decision date, so the release date is used.

The PIPC imposed a KRW 168 million surcharge for failing to supervise a contractor, including not checking that personal data was destroyed. The decision came in the same release as the sanction on the Ministry of the Interior and Safety and a contractor.

The PIPC imposed a KRW 273 million surcharge and KRW 7.5 million in fines (recorded together) on the ministry for skipped software testing on its Government24 service, an unfixed authentication flaw, a breach notice made after 72 hours and an omitted subcontractor in the privacy policy. It also issued a corrective recommendation and a publication order.

The FSC imposed a KRW 1,470.5 million surcharge for financial statements that breached accounting standards, plus KRW 103.8 million on three company officials who are not named. A footnote says the KRW 10 million surcharge on one of those officials, and auditor designation, had already been imposed by the Securities and Futures Commission on 11 March 2026.

The PIPC imposed a KRW 280 million surcharge and a KRW 7.2 million fine (recorded together) after a voice-phishing call let a hacker into the personal data system, exposing data of 620 Korean members. It also found resident registration numbers collected without a legal basis, unencrypted identity document numbers, and a breach report made after the 72-hour limit.

The PIPC imposed a KRW 378 million surcharge and a KRW 4.8 million fine (recorded together) for missing access controls, a weak encryption algorithm, access logs kept for under a year and incomplete breach notices. A hacker downloaded data on 973 officials in March 2024.

The PIPC imposed a KRW 532 million surcharge because the service approved access requests despite signs of forged documents, left access open for staff no longer in the role, and did not review access logs. An outsider viewed records of 1,036 public employees between April 2022 and October 2023.

The FSC imposed a KRW 170 million surcharge on the audit firm for inadequate audit procedures in the Bolvik case.

The FSC imposed a KRW 1.77 billion surcharge for financial statements prepared in breach of accounting standards, and KRW 290 million combined on the former CEO and one other person, not named. Auditor designation had been decided earlier by the Securities and Futures Commission in January 2026.

The PIPC imposed a KRW 9.62 billion surcharge and a KRW 4.8 million fine (recorded together) for logging resident registration numbers in plaintext in online payment logs without a legal basis and leaving the logs inadequately encrypted. It also ordered a review of the personal data processing system, stronger Chief Privacy Officer independence and publication of the decision. The credit-information side of the same breach was handled separately by the FSC.

The PIPC imposed a KRW 2.412 billion surcharge and a KRW 7.2 million fine (recorded together) after voice phishing gave hackers access and about 4,600 records leaked. The company had no IP restriction or limit on bulk downloads and reported the breach late.

The PIPC imposed a KRW 12.236 billion surcharge and a KRW 3.6 million fine (recorded together) after a voice-phishing call let hackers into a SaaS system and about 1.95 million records leaked. The company did not restrict access by IP address, did not review access logs at least monthly, and notified the breach after the 72-hour limit.

The PIPC imposed a KRW 21.385 billion surcharge after hackers used credentials stolen from an infected employee device to reach a SaaS account and take about 3.6 million records in three incidents in June 2025. Access was not limited by IP address and external access lacked secure authentication. The same release sanctions Christian Dior and Tiffany.

The PIPC imposed a KRW 703 million surcharge and a KRW 4.8 million fine (recorded together) over the JAMS journal system, where a flaw present since 2013 went unfixed and about 120,000 members' data was exposed. It also found an incomplete breach notice and ordered vulnerability checks and a re-notification.

The PIPC imposed a KRW 534 million surcharge and ordered T-money to put measures in place to prevent a recurrence and to publish the decision. A credential-stuffing attack in March 2025 made over 12 million login attempts and reached 51,691 member accounts, and the company did not respond adequately to the abnormal logins.

The FSC imposed a KRW 283.5 million surcharge on the audit firm for inadequate audit procedures, in a release that also sanctions Wellbiotec and Dongsung Finetec.

At its 22nd meeting the FSC imposed a KRW 1,092.8 million surcharge for financial statements prepared in breach of accounting standards, and KRW 309.5 million on its former CEO and two others, who are not named. The release also covers Dongsung Finetec and Shinhan Accounting.

An insider who learned of a company's planned share buyback before it was public bought about KRW 120 million of stock through a spouse's account and gained about KRW 24.3 million. The Securities and Futures Commission set a surcharge of KRW 48.6 million, twice the gain, at its 18 September 2025 meeting, after referring the case to prosecutors on 18 June 2025.

Hackers breached SKT's core systems, affecting about 23.2 million LTE and 5G users. The PIPC imposed a surcharge of KRW 134.791 billion and a KRW 9.6 million fine for late breach notification, ordered correction and recommended extending ISMS-P certification to the mobile network. Decided on 27 August and announced on 28 August 2025.

In the same action, the FIU gave Dunamu's chief executive a reprimand with warning. The release also dismissed the reporting officer and the compliance officer, reprimanded five team leaders and cautioned two.

After an on-site AML inspection from August to October 2024, the FIU barred Dunamu from processing virtual asset transfers for new customers from 7 March to 6 June 2025, citing 44,948 transfers involving 19 unregistered overseas operators. The release left the fine for a later committee decision. Besides the CEO, nine staff were sanctioned: two dismissed, five reprimanded and two cautioned.