432 Personal Information Leakage Reports Filed in the First Half of This Year Alone... Nearly Matching Last Year's Full-Year Total

[Financial News] Personal information leakage incidents have surged across both large corporations and public institutions, with 432 reports filed with the Personal Information Protection Commission in the first half of this year alone—nearly matching the total for all of last year. 
The number of personal information leakage incidents reported to the Personal Information Protection Commission rose from 167 in 2022 to 318 in 2023, then reached 447 in 2025. 
The PIPC has decided to strategically manage reported cases according to their scale and importance. It will focus on "major" cases involving the leakage of personal information belonging to at least 1 million people, with a goal of processing them within 12 months. Ordinary and minor cases will be concluded within six and three months, respectively, allowing investigative resources to be concentrated on major cases. 
On the 2nd, the PIPC announced that it had formulated and would fully implement the "Measures to Expedite Investigations into Personal Information Leakage and Breach Incidents and Strengthen Investigative Capabilities" in response to the rapid increase in personal information leakage and breach incidents as attacks targeting personal information become more sophisticated and advanced alongside the spread of artificial intelligence (AI) technology. 


The goal is to process ordinary and minor cases swiftly and concentrate investigative capabilities on major cases. In particular, the PIPC plans to reduce unnecessary investigations into minor cases and shift to a post-incident management system for small and micro businesses. The system will focus on addressing the causes of incidents and preventing recurrence through measures such as waiving the first administrative fine and providing technical support.
"Major" cases include incidents involving large-scale damage, such as leaks of personal information belonging to at least 1 million people; matters attracting intense social attention and concern; and cases in which major public systems have been hacked.
PIPC Chair Song Kyung-hee said, "As personal information leakage and breach incidents surge and large-scale, complex cases become more common, it is necessary to allocate investigative capabilities according to the importance and characteristics of each case rather than handling every case in the same manner."
The PIPC also plans to activate its subcommittees to reduce the burden on plenary meetings as the number of cases increases. It will revise procedures so that subcommittees, which currently handle mainly administrative fine cases, can also process low-value surcharge cases of up to 100 million won. The PIPC plans to eventually allow subcommittees to handle surcharge cases of under 300 million won and under 1 billion won.
The PIPC also plans to make active use of AI to strengthen investigative capabilities. In 2028, it plans to build the AI Search Database for the Investigation Information System, containing investigation reports, disposition cases and laws. Investigators will be able to quickly search relevant materials using natural-language queries alone and use supporting information, such as the original sources presented with the results, in their investigations.

[email protected] Lee Gu-sun Reporter