SEOUL, May 23 (AJU PRESS) – Korea's personal data watchdog on Thursday imposed a record 15.1 billion won ($11.1 million) fine on Kakao Corp., which runs the nation's largest mobile messaging app, after a major data breach exposed more than 65,000 user records.
The Personal Information Protection Commission made the decision the previous day after finding Kakao failed to properly encrypt user IDs for its open chat rooms, allowing hackers to access linked account numbers and other private data. At least 65,719 user records were leaked and illegally sold online, according to the commission.
The penalty is the largest ever imposed for a personal data breach. The previous record was 75 billion won, levied on Golfzon.
Investigators found that hackers exploited vulnerabilities in Kakao's open chat rooms to uncover participants' temporary IDs, through which they obtained the account numbers of their chat friends. They are believed to have sold the information on Telegram and other platforms.
While Kakao began encrypting new open chat room IDs in August 2020, older chat rooms remained exposed. The company also failed to act despite public reports of account data being marketed by criminal outfits.
Kakao was also hit with an additional 78 million won fine for failing to report the breach to authorities and notify impacted users.
"We hope that this will serve as an opportunity to recognize that for services used by the vast majority of the public, such as KakaoTalk, it is as important to continuously check and work on possible privacy violations that may occur during the design and development process as it is to improve security vulnerabilities," the commission said.
Kakao countered that account numbers and temporary IDs alone cannot identify individuals. The company said it plans to pursue all available legal actions, including an administrative lawsuit, against the ruling.
