9 Out of 10 Major Personal Data Breaches Involved Violation of 'Safety Measure Obligations'

It has been found that in 9 out of 10 major personal data breach incidents, there was a violation of the security measure obligations stipulated in the Personal Information Protection Act. While the number of incidents has decreased, a series of large-scale breaches leaking tens of millions of records at once has led to a sharp increase in the overall volume of data breached.

Representative Kim Jongmin. Provided by Representative Kim's Office

According to Representative Kim Jongmin (Sejong Gap), a member of the National Assembly’s Trade, Industry, Energy, SMEs, and Startups Committee, who received the “Status of Dispositions in Data Breach Incidents from 2021 to June 2026” submitted by the Personal Information Protection Commission on October 1, 390 cases (74.3%) out of 525 incidents of data breaches resulting in legal disposition involved violations of Article 29 of the Personal Information Protection Act regarding security measure obligations.

Notably, among 19 large-scale incidents where more than 1 million records were breached, 17 cases (89.5%) involved violations of security measure obligations. This is 15.7 percentage points higher than the violation rate among incidents involving fewer than 1 million records (73.8%).

Article 29 of the Personal Information Protection Act requires organizations to implement security measures such as establishing internal management plans, access control, encryption of sensitive data, and retention of access logs to prevent the loss, theft, or leakage of personal data.

The phenomenon of large-scale incidents driving the overall volume of data breaches was also pronounced. In 2025, 93 incidents that resulted in legal dispositions accounted for a total of 48,158,734 leaked records, which is approximately 8.2 times greater than the 5,907,863 records in 2024. By contrast, the number of incidents resulting in disposition decreased by 9.7%, from 103 cases in 2024 to 93 in 2025.

In 2025, the SK Telecom incident alone accounted for 31,644,648 records, representing 65.7% of the total data breached that year. In the first half of this year, a single incident at Coupang resulted in the leakage of 33,222,472 records—75.9% of the cumulative 43,743,251 records leaked in 2026. In other words, a single incident accounted for more than two-thirds of total data breached for the respective year.

This statistic is based on the year of regulatory disposition by the Personal Information Protection Commission, not the time the incident occurred. Additionally, the number of leaked records may include duplicates for the same individual, so it differs from the actual number of affected people.

Representative Kim stated, "In 9 out of 10 large-scale data breaches, violations of security measure obligations were confirmed, and the proportion was higher than in the overall set of data breach incidents." He added, "Instead of viewing large-scale leaks solely as unavoidable hacks, companies and institutions must first be checked on whether they have properly implemented the basic security measures." He further emphasized, "The security measures set out in Article 29 of the Personal Information Protection Act are the minimum line of defense against large-scale breaches. There must be proactive assessments of whether these measures are being implemented in major personal data processing systems, and those organizations and companies found lacking must be managed until improvements are completed."

This content was produced with the assistance of AI translation services.