Personal Information Protection Commission

The PIPC found that a 2025 breach at Coupang, carried out by a former employee using authentication signing keys the company had not revoked, stemmed from basic security failures rather than sophisticated hacking, and that Coupang notified it late. Separately, it found that Coupang collected the online behaviour of about 11.17 million users on other websites and apps without consent.

South Korea's PIPC found that hackers extracted authentication credentials from KT's femtocells, loaded them into rogue femtocells and used them to reach KT's network, intercepting traffic between subscribers' phones and the network from October 2024 to September 2025. The commission held that KT owned and operated the femtocells and failed to apply baseline access controls to its internal network.

South Korea's PIPC fined Meta for collecting sensitive data, including religion, political views, and sexual orientation, on roughly 980,000 users for advertising without consent.