On 28 October 2026, at its 21st plenary meeting, South Korea's Personal Information Protection Commission (PIPC) resolved to impose a KRW 3.255 billion fine on the education company Daekyo and a KRW 630 million fine on the Young Hoon Medical Group, KRW 3.885 billion in total. Both were penalised for failing to meet the safeguard obligations of the Personal Information Protection Act (PIPA). The PIPC's English release says about 650,000 Daekyo users had names, birthdates, phone numbers and connection information (CI) exposed, and that 188,481 Young Hoon users were affected.
The strongest case for tough enforcement
The argument for severe penalties is serious. Breached data cannot be recalled, and victims bear the cost of phishing, identity fraud and harassment long after a company has moved on. A fine that is cheap relative to revenue is just a cost of doing business. South Korea has also seen very large incidents. JoongAng Daily reports that Coupang was fined KRW 624.6 billion in June after a leak affecting 37.55 million people. Regulators who see repeated, avoidable failures reasonably want a credible deterrent.
What the PIPC actually punished
The findings in these two cases are notable for how ordinary they are. At Daekyo, attackers entered through web vulnerabilities on affiliates' websites. According to the PIPC and the Korean outlet Byline Network, Daekyo allowed unnecessary access from those affiliate web servers to its member database, which widened the damage. The PIPC release also says the company was briefed by its security control provider about anomaly detection results but failed to follow up.
At Young Hoon, the PIPC said the group failed to install and operate a web application firewall. Byline adds that the group did not check for web flaws such as SQL injection or validate input, used an insecure algorithm to encrypt member passwords, and applied no salt.
None of this is exotic. These are checklist items that any competent security programme covers. The sanction is tied to a specific, demonstrable failure, which is the form of enforcement that best fits a pro-innovation position. A company can know in advance what it must do, and a regulator can show what it did not do. Both firms also received correction orders, and Daekyo was ordered to publish the sanction.
The amendment context, and a caution
The fines landed about seven weeks after a PIPA amendment took effect on 11 September 2026. According to JoongAng Daily, the amendment lifts the cap for the most serious cases from 3% of sales to 10% of total revenue. The Hunton Andrews Kurth summary lists the triggers: intentional or grossly negligent violations repeated within three years, such conduct affecting 10 million or more people, or failing to follow a PIPC corrective order and then suffering a breach.
These cases should not be read as the new ceiling in action. The PIPC release we reviewed does not mention the amendment or a 10% cap. The Daekyo breach affected roughly 650,000 people, well under the 10-million threshold. The incidents date from 2024 and 2025, and Young Hoon's is from March 2024. We could not confirm from the sources reviewed which version of the penalty rules applied, or what transition provisions govern older breaches. Treating these decisions as proof of how the 10% tier will be used would be speculation.
What they do show is the PIPC's baseline: it is willing to fine mid-sized, non-platform organisations, including a hospital operator, for foundational lapses. That signal reaches far more companies than a rare, extreme case would.
Where proportionality matters
The risk in the new regime is not these fines. It is the incentive structure around a revenue-based ceiling. A cap pegged to total revenue, rather than revenue from the affected service, can produce penalties that bear little relation to harm or fault, especially for diversified groups. Korea's design does include limits: the triggers require intent or gross negligence, repetition, or defiance of an order. The JoongAng report also says fines can be reduced by up to 40% for prior investment in protection and for early detection and prompt notification, and that companies must now notify users within 72 hours when a high risk of exposure is identified. Those mitigation paths are the part of the law most worth defending.
For policymakers and companies, three practical points follow:
- Define the safe harbour. Reductions for security investment only work if firms know which controls count. The PIPC's published findings, covering WAFs, access segmentation, salted hashing and follow-up on alerts, are a useful starting list.
- Keep the top tier narrow. The 10% ceiling should remain tied to aggravated conduct. Applying it to ordinary negligence would chill the startups and mid-sized firms that Korea wants to build.
- Publish reasoning. Detailed findings, as in these cases, let the whole market learn from one enforcement action rather than from guesswork.
Bottom line
Daekyo and Young Hoon are not evidence that bigger caps work. They are evidence that targeted, reasoned enforcement of basic security duties is already possible under existing law. If the PIPC keeps penalties tied to identifiable control failures, and keeps the 10% tier for genuinely aggravated cases, Korea can protect users without pushing firms toward defensive over-compliance. The test will come when the first case under the new ceiling is decided and its reasoning is published.