Personal data breaches are routine — and companies face little consequence

Firms collect far more than they need, while security spending lags

Investigations drag on; victims struggle to win meaningful compensation

According to the Personal Information Protection Commission, a work computer belonging to an employee who handled personal data at Duo was hacked in January last year, resulting in the personal information of 427,464 full members being leaked. Shown is the sign outside the headquarters of Duo Information, a matchmaking company. [Yonhap]
According to the Personal Information Protection Commission, a work computer belonging to an employee who handled personal data at Duo was hacked in January last year, resulting in the personal information of 427,464 full members being leaked. Shown is the sign outside the headquarters of Duo Information, a matchmaking company. [Yonhap]

"Every piece of information about a person's entire life was stolen, and it's just being swept under the rug. I'm furious."

A worker in their 40s based in Seoul who was affected by the personal data breach at matchmaking company Duo — which occurred in January last year — said they had "still not received any apology or compensation." The data leaked in the incident covered 49 categories of personal information, including resident registration numbers, height, weight, educational background, car brand, parents' assets and workplace addresses. The breach exposed an enormous trove of detail capable of laying bare a person's private life.

Police have been investigating the Duo data breach for nearly two years, but their focus is on the hackers who carried out the cyberattack — not the company that allowed the breach to happen. A Korean National Police Agency official said that while a victim company could face scrutiny over failures to meet data-security obligations, such violations are subject to administrative fines rather than criminal punishment.

Investigations have dragged on because cyberattacks often originate overseas or route through foreign servers, making suspects hard to trace and requiring international cooperation. The case involving the leak of SK Telecom SIM card data in April last year has stalled as police struggle to identify the perpetrators. A separate large-scale breach at Lotte Card, which first came to light in September of the same year, was initially attributed to outside hackers, but police have yet to identify a suspect and the investigation continues.

2.88 million resident registration numbers leaked over five years

Millions of records have been exposed through various security incidents over the past five years. Data submitted by the Personal Information Protection Commission to the office of People Power Party lawmaker Park Sung-hoon of the National Assembly's Political Affairs Committee shows that 2,882,630 resident registration numbers were confirmed leaked between 2021 and May this year.

Of that total, 76 percent — 2,195,507 — were leaked in just 17 months between January last year and May this year. That period saw a string of major hacking incidents and data breaches. According to the Personal Information Protection Commission, the Duo breach alone exposed 427,464 resident registration numbers, while the Lotte Card incident resulted in 452,314 being leaked.

A Personal Information Protection Commission chart showing the number of resident registration numbers leaked each year from 2021 through May this year, produced using ChatGPT. [Provided by Rep. Park Sung-hoon's office]
A Personal Information Protection Commission chart showing the number of resident registration numbers leaked each year from 2021 through May this year, produced using ChatGPT. [Provided by Rep. Park Sung-hoon's office]

A 34-year-old resident of Goyang, Gyeonggi Province, said they had received so many breach notification messages this year that they could no longer keep track of what had been taken or from where. "It feels like personal data has already become public property," the resident said. "I wonder if the government should just reissue everyone's resident registration numbers."

Victims who want redress must take matters into their own hands and pursue legal action themselves. The Seoul worker whose Duo membership data was leaked said the information exposed was "not just basic personal details — I'm worried about how it could be misused."

Leaked resident registration numbers can lead to further harm such as identity theft. But receiving compensation solely on the basis of a leak is difficult: victims must separately prove that the exposure caused them financial loss. Even when damages from a simple leak are recognized, compensation typically amounts to only 100,000 to 300,000 won per person. The Personal Information Protection Commission's proposed compensation figure for victims of the SK Telecom SIM card hack was also 300,000 won ($221) per person.

Streaming a drama series requires your contact details and date of birth?

Experts say excessive data collection must stop

As cyberattacks multiply, corporate data-retention practices are drawing fire. Critics say companies must stop demanding personal information well beyond what their services actually require.

Attorney Kim Min-ji of law firm New Lawyer said Duo had no legitimate reason to collect resident registration numbers in the first place, and that the breach was a direct consequence of doing so. "The practice of collecting unnecessary information as a matter of routine must change," Kim said. The Personal Information Protection Act requires companies to collect only the minimum amount of personal data needed for a stated purpose.

Tving, the online video streaming platform that suffered a data breach in June, required users to provide their name, gender, date of birth and email address as mandatory information simply to use the service. Law firm Jihyang described this in a class-action guidance notice as "the forced collection of excessive personal data."

Park Bo-ra, a research fellow at the Korea Institute for National Security Strategy's future strategy research division, said South Korea's cybersecurity investment has broadly lagged behind the country's high level of digitalization.

Major banks targeted in a series of cyberattacks last month had in fact been underspending on security. Data obtained by Park Sung-hoon's office showed that KB Kookmin Bank and Suhyup Bank spent only 58 percent and 60 percent, respectively, of their allocated information-security budgets last year. Financial regulators also found during inspections that some institutions had failed to meet even basic security requirements, including mandatory data encryption and the installation of antivirus software.

Kwon Heon-yeong, a professor in the Department of Information Security at Korea University, said individuals also bear some responsibility. "Before consenting to data collection, people need to ask themselves why so much of their information is needed," Kwon said. "You should not be generous when agreeing to the use of your personal data."


arin@heraldcorp.com
kido@heraldcorp.com