On August 10, 2026, the FBI, CISA, DC3, NSA and US Secret Service, together with the Korean National Police Agency, issued joint #StopRansomware advisory AA26-222A on the Gunra ransomware group. According to the advisory, Gunra is a ransomware-as-a-service operation that emerged in April 2025, was built from leaked Conti source code, and formalised an affiliate programme in early 2026. It uses double extortion: steal data, encrypt systems, then threaten publication. Its affiliates get in through two known authentication-bypass flaws in Fortinet FortiOS and FortiProxy, CVE-2024-55591 and CVE-2025-24472, and give victims 5-7 days to start negotiating.
The advisory's most useful detail is technical. The Linux variant seeds its random number generator with the system clock, which lets victims reconstruct keys from file timestamps and recover data without paying. A criminal enterprise that made a basic cryptographic error is a reminder that ransomware policy should not assume attackers are invincible. Its entry point was a flaw that already had a patch.
The case for tougher liability
The strongest argument for harsh penalties is that breach victims are poorly placed to price their own negligence. Customers cannot audit a carrier's patch cadence, and a fine that is small relative to revenue becomes a cost of doing business. Korea has evidence for this view. In August 2025 its privacy regulator fined SK Telecom 134.8 billion won, the largest penalty under the Personal Information Protection Act. According to The Korea Herald, the regulator found SKT had left 26.1 million SIM authentication keys unencrypted, ignored intrusion-detection logs and neglected available security patches, including one from 2016. When negligence is that basic, a credible penalty is defensible.
Korea has now hardened that approach. A February 2026 amendment to PIPA raises the penalty ceiling from 3% to up to 10% of total revenue in narrow cases. These are repeated intentional or grossly negligent violations within three years, breaches affecting 10 million or more people, and failure to follow a corrective order. As Hunton Andrews Kurth summarises, it also extends breach notification to "forgery, alteration and damage", which covers ransomware, requires notice on a "meaningful possibility" of an incident, and treats the business owner or representative as ultimately responsible. Most provisions take effect on September 11, 2026, about a month after the Gunra advisory.
Where the design is right, and where it is thin
Several choices are sound. Coverage of ransomware-style damage closes a gap, since an encrypted database may never be "leaked" in the classic sense. The 10% ceiling is limited to aggravating conditions rather than applied to every incident. Companies may also seek reductions by showing real investment in staffing, budget and technical safeguards. That last feature matters most, because it rewards the behaviour Gunra's victims lacked.
The weak point is the trigger. A notification duty that starts on a possibility, before an incident is verified, risks a flood of premature notices that regulators and the public tune out. Regulators in Korea's public sector already face growing volume: the Personal Information Protection Commission reports public-sector breach reports rising from 23 in 2022 to 128 in 2025. More reporting is not the same as more security, and triage capacity is finite.
A turnover-based fine also punishes the victim of a crime. Gunra's affiliates are the wrongdoers, and they sit beyond Korean jurisdiction. The advisory's own mitigations are ordinary: patch known exploited vulnerabilities quickly, keep offline immutable backups, segment networks, enforce multi-factor authentication and audit administrator accounts. None of it needs a statute. The policy question is whether the law makes firms do it, without pushing them toward defensive paperwork.
What proportionate policy looks like
The Electronic Frontier Foundation made a related argument this month about US AI-security legislation. It urged lawmakers to tie rules to well-established cybersecurity best practices rather than rigid technical mandates, and to fund independent investigation of serious incidents. The same logic fits Korea's ransomware problem.
- Publish a patch-latency yardstick. Regulators should say which safeguards earn mitigation, for example patching internet-facing VPN and firewall appliances within a stated window after a known-exploited listing. Firms then know what compliance looks like before an incident.
- Keep the 10% ceiling for the aggravated cases only. Repeat offenders and ignored corrective orders justify it. A first-time victim that patched late does not.
- Protect voluntary reporting. Fast, honest notification of a Gunra-type intrusion should count in a firm's favour. Otherwise firms may hesitate to report early, given the exposure the new rules create.
- Share decryption findings. The Linux flaw shows what joint police work can yield. Sharing such weaknesses with victims quickly is worth more than another penalty tier.
The Gunra advisory is a rare case where the attacker's failure and the defender's failure are both plain. Fortinet appliances with known flaws were the door, and a clock-seeded random number generator was the crack in the lock. Korea's amended PIPA gives regulators a heavy stick. The test in the coming year is whether they pair it with clear, published expectations on patching and prompt reporting, so that the firms doing the basics well are treated differently from those that ignore warnings. Deterrence works best when the rule is specific enough to follow.