Record breaking due to poor protection of personal information! Korean version of Tencent receives huge fine

rare! Kakao, the Korean version of Tencent, received a record fine.

On Thursday, May 23, local time, according to South Korea's Yonhap News Agency, South Korea's Personal Information Protection Commission fined South Korean Internet giant Kakao 15.1 billion won for leaking the personal data of at least 65,710 users. This is South Korea's personal information protection commission. The highest penalty ever imposed on a domestic company. The Korean Personal Information Protection Commission approved the fine at a plenary meeting, arguing that Kakao's lax review and protection of user data led to large-scale data leaks.

fined over NT$80 million, the highest penalty imposed by a Korean company

Public information shows that Kakao is a technology company headquartered in South Korea. The company is vividly called the Korean version of Tencent and is famous for its communication application KakaoTalk, which is one of the most popular instant messaging platforms in South Korea. Kakao's business scope is broad and covers multiple fields, including social networks, mobile games, music, web search and e-commerce.

KakaoTalk, Kakao's flagship product, provides text and voice messaging, video calling functions, and multimedia sharing services. In addition, KakaoTalk also provides various life services and convenient functions, such as payment services, news reading, and taxi ordering.

According to previous news, PIPC launched an investigation into Kakao in March 2023 because user information on the company's messaging application KakaoTalk was illegally traded. Cybercriminals gained access to users' personal information by identifying their temporary IDs used by anonymous chat services and sold the data through Telegram Messenger.

According to reports, PIPC approved the fine at a plenary meeting on May 23, 2024, arguing that Kakao's lax user data review and protection measures led to large-scale data leaks.

It is understood that Golfzon, another Korean company that operates golf simulator products, was attacked by hackers with ransomware in November 2023, causing the personal information of 2.21 million users to be leaked. Among them, the ID numbers of 5,831 people and the private account information of 1,647 people were also leaked. After half a year of investigation, PIPC announced on May 9, 2024 that it would impose a record-high fine of 7.504 billion won on Golfzon. It is worth mentioning that the fine imposed on Kakao this time reached 15.1 billion won.

Hackers took advantage of lax data protection regimes on open chat services to steal users' personal information and sell it, according to PIPC findings. PIPC believes that Kakao did not take the necessary protective measures to encrypt users' temporary IDs, allowing hackers to identify the serial numbers assigned to each user. At the same time, when users reported concerns about their data being leaked, Kakao failed to check and resolve the data leakage in a timely manner, and failed to report the situation to PIPC after becoming aware of the incident.

A PIPC official said the agency had confirmed that hackers accessed the personal data of at least 65,710 users, adding that police were currently investigating the specific scope of the data breach.

Kakao disputed this claim, saying it was impossible to identify each user based on serial numbers and temporary IDs alone. And said in a statement: "Temporary IDs do not contain any type of personal information, and relevant laws do not mandate encryption of serial numbers." Kakao emphasized in the statement: "Since the launch of the open chat service, we have been using Masking technology to hide the temporary ID. Since the hacker illegally collected the information, Kakao should not be held responsible for the leak."

The company also stated that it immediately reported the matter to the police and the Ministry of Science after learning of the matter, and faithfully cooperated with the investigation in response to the PIPC decision, while not ruling out filing lawsuits.

Executives manipulate stock prices, Kakao security issues occur frequently

It is understood that this is not the only data leakage incident of Kakao. As early as November 2023, Kakao's shopping application ZigZag experienced a security breach, resulting in the unauthorized disclosure of customer personal information. The security breach occurred when some customers were surprised to see other users' private information displayed instead of their own when trying to log in.

The personal information exposed at the time included names, shipping addresses, order history and stored payment methods, all of which were accessible through the MyPage section of the app. This security issue lasted for a long time, and Kakao did not take emergency measures such as suspending login during this period. According to a user who wrote on his social media at the time, he inadvertently logged in with someone else's ID every time he refreshed the page, so he chose to delete his account.

Kakao blamed the security breach on "an infrastructure error related to the storage of logged-in member information" and promised to announce a compensation plan and develop measures to prevent such leaks after assessing the full scope of the damage.

A Kakao spokesperson said at the time: "ZigZag provides global services in the United States, Canada and Japan, but so far there are no reports of foreign customers being affected by this breach."

The incident came as Kakao and its subsidiary Kakao Entertainment were also involved in accusations of stock manipulation, with South Korean authorities arresting Kakao's chief investment officer Bae Jae-hyun in October 2023, accusing him of stock price manipulation.

It is understood that Kakao won a controlling stake in South Korea's SM Entertainment in a fierce bidding war with South Korea's multinational entertainment company Hybe. South Korea's financial regulator accused Bae Jae-hyun and two other employees working at Kakao of buying SM shares worth 240 billion won in an attempt to undermine Hybe's offer.

Data shows that this bidding war also caused SM's stock price to soar to a record high in March 2023, and Hybe also withdrew from the bidding in March 2023.