[Alpha Biz= Kim Jisun] Kakao Corp. lost a legal challenge against a record administrative fine imposed over a large-scale personal data breach involving approximately 65,000 user records.

On January 15, the Seoul Administrative Court’s 14th Division ruled against Kakao in a lawsuit seeking to overturn sanctions, including a fine and corrective orders, imposed by the Personal Information Protection Commission (PIPC).

The PIPC launched an investigation in 2023 following media reports that personal data of KakaoTalk open chat users was being illegally traded. The investigation found that Kakao had inadequately managed user information, resulting in the leakage of approximately 65,000 records. In May 2024, the commission imposed a fine of about KRW 15.1 billion—the largest ever levied for violations of South Korea’s Personal Information Protection Act—citing Kakao’s failure to implement adequate security measures.

In November 2024, Kakao filed an administrative lawsuit, arguing that the PIPC’s sanctions were unjustified. However, the court upheld the regulator’s decision.

The court ruled that an open chat database combining information such as mobile phone numbers, profile names, open chat room names, and related profile data—when exposed online and sold—constitutes a personal data breach. It further held that Kakao acted unlawfully by failing to report the data breach to authorities and notify affected users.

 

 

 

[ⓒ 알파경제. 무단전재-재배포 금지]