South Korea's PIPC levies KRW 12.95 billion in fines

Cresthaven AnalyticsIntelligence Brief

Headline

South Korea's PIPC levies KRW 12.95 billion in fines against GS Retail and three operators for personal data breaches

Executive Summary

The Personal Information Protection Commission (PIPC) imposed aggregate fines of KRW 12,954,440,000 and KRW 10,200,000 in administrative penalties against GS Retail and three other operators at its 17th plenary session on August 26, 2026. The violations concerned personal data protection failures under the Personal Information Protection Act. The Commission also issued corrective orders, including measures to prevent recurrence, and ordered publication of the results on the relevant operator's website.

Bottom Line

The PIPC's August 26 plenary session imposes KRW 12,954,440,000 in fines and KRW 10,200,000 in administrative penalties across four operators, with GS Retail accounting for KRW 12,836,000,000 of the fine total. GS Retail's corrective order covers technical access controls, abnormal-traffic detection, dedicated privacy staffing, and CPO governance. The SKT and A-Tos dispositions establish that both the delegating principal and the delegated processor carry exposure when a third-party-operated service results in a breach. Cresthaven reading: operators running multi-service digital platforms and those using delegated processors for marketing or event services face concurrent liability exposure under the PIPC's demonstrated enforcement posture.

Key Regulatory Signals

GS Retail Bears the Largest Penalty: GS Retail received a fine of KRW 12,836,000,000 and an administrative penalty of KRW 3,000,000. The Commission found the company failed to detect or block large-scale login attempts from the same IP address in a short period, allowing credential-stuffing attacks on GS SHOP from June 21, 2024 to February 13, 2025 and on GS25 from December 26, 2024 to January 4, 2025. GS SHOP saw 1,581,025 individuals' personal data exposed; GS25 saw 79,128 individuals' personal data exposed.
Delayed Cross-Platform Response Prolonged the GS Retail Breach: GS Retail first identified the GS25 breach on January 4, 2025 but did not identify the concurrent GS SHOP attack until February 2025, allowing continued data exposure from January 4 to February 13, 2025. The Commission also found that 1,599 additional affected individuals identified during the investigation were notified of the breach after the 72-hour statutory deadline without justification.
GS Retail Ordered to Overhaul Governance and Prevention Measures: The corrective order requires GS Retail to establish security policies capable of identifying abnormal access through traffic-volume and pattern analysis, assign dedicated personal data protection personnel, and clarify the authority and responsibilities of its Chief Privacy Officer. Cresthaven reading: operators running multi-brand digital platforms face compounded exposure where a single attacker infrastructure spans services and delayed cross-service detection extends both the breach window and the notification violation.
Enrise Fined for Authentication Vulnerability and Access-Control Failures: Enrise, operator of a dating application, received a fine of KRW 118,440,000 and an administrative penalty of KRW 3,600,000. The Commission found the company neglected to inspect or remediate an identity-authentication vulnerability in its app and did not configure a blocking policy for excessive access from the same IP address.
SKT Penalized and A-Tos Warned Over Delegated Event Service Breach: SK Telecom received an administrative penalty of KRW 3,600,000 and a corrective order for notifying and reporting the breach of 1,140 individuals' personal data beyond the 24-hour deadline then applicable to telecommunications service providers under the prior personal data protection statute. A-Tos, the delegated operator of the event website, received a warning after the Commission found it had not applied IP-address restrictions or other access controls to the administrator page, which was exposed through a search engine between November 21, 2022 and January 3, 2023.
Commission Reaffirms Access-Control and Notification Baseline: The PIPC used this enforcement action to re-emphasize compliance with basic principles such as restricting unauthorized access to personal data processing systems and periodic vulnerability inspection, and urged breach reporting and notification within 72 hours. The Commission asked operators to ensure that affected individuals can be informed promptly when a breach occurs.

Regulatory Delta

The PIPC continues its pattern of multi-operator plenary dispositions that combine fines, corrective orders, and mandatory public disclosure, consistent with prior enforcement cycles under the Personal Information Protection Act.
GS Retail's fine of KRW 12,836,000,000 accounts for the dominant share of the session's total assessed amount. The corrective order against GS Retail extends beyond technical remediation to CPO governance and dedicated staffing requirements.
The concurrent disposition of SKT and A-Tos shows the PIPC holding both the delegating principal and the delegated processor liable in outsourced service arrangements. Operators using third-party event or marketing platforms should treat this as directly relevant to their own exposure.

Materiality Classification

MEDIUM — Multi-operator enforcement action with corrective orders and mandatory public disclosure; sector-wide signal on access-control, vulnerability inspection, and 72-hour breach-notification obligations, but penalties and orders land on named respondents rather than restructuring the compliance baseline for the broader regulated population.

Intelligence Outlook

Monitor the PIPC for publication of the ordered public disclosure on GS Retail's website and for any follow-on guidance or FAQ addressing access-control and CPO governance standards referenced in the GS Retail corrective order.