From 2022 to August 2026, there were 144 cases in which public agencies were penalized for personal data leaks The leak size stated in the penalty decisions is 9,019,433 records

On October 14, lawmaker Park Sung-hoon (People Power Party, National Policy Committee) disclosed data he received from the Personal Information Protection Commission By number of penalties, work errors were the most common; by number of leaked records, hacking was

Concept shot of personal data leaking out of public agency files and servers Concept shot of personal data leaking out of public agency files and servers — Source: concept shot, self-generated with agy

Causes of the 144 penalties

Bar chart of the 144 public agency leak penalties by cause Bar chart of the 144 public agency leak penalties by cause — Source: self-rendered based on data submitted by the Personal Information Protection Commission

Of the 144 penalties, work errors were the most common at 86 (59.7%) Hacking accounted for 37 (25.7%), system errors 13, intentional leaks 5, and other causes 3

Park pointed out that public agencies have far more leaks from work errors than from hacking, and said their management systems need to be reviewed

Size of leaks by cause

Bar chart comparing the number of personal data records leaked through hacking and through work errors Bar chart comparing the number of personal data records leaked through hacking and through work errors — Source: self-rendered based on data submitted by the Personal Information Protection Commission

Compared by number of leaked records rather than number of penalties, the ranking is reversed

Data leaked through hacking amounted to 6,001,145 records (about 66.5%) Work errors accounted for 1,393,766 records (15.5%)

In this tally, work errors drew more penalties but leaked less than hacking Hacking drew fewer penalties but leaked more data

Agency Leaked records
Gyeonggi Provincial Office of Education 2,966,485
Korea National Council on Social Welfare 1,353,327
National Center for the Rights of the Child 1,146,113

The top three agencies by leak size total about 5.46 million records, about 60% of the whole

Penalties by year and the share with disciplinary recommendations

Bar chart of public agency leak penalties by year from 2022 to August 2026 Bar chart of public agency leak penalties by year from 2022 to August 2026 — Source: self-rendered based on data submitted by the Personal Information Protection Commission

Penalties peaked at 47 in 2023 2026 already had 38 through August, exceeding the 27 for all of 2025

Monetary sanctions were 33 penalty surcharges totaling ₩5,402,650,000 and 97 administrative fines totaling ₩464,000,000 The total is about ₩5,866,650,000

Penalties that included a disciplinary recommendation were 9 of 144 (6.3%)

The disciplinary recommendation share is based on the commission’s penalty decisions It does not include disciplinary actions agencies took on their own

When notification is delayed

At the Health and Welfare Committee’s parliamentary audit the same week (October 16), the National Health Insurance Service case came up

An employee who had provided subscriber and dependent data to outsiders without authorization for about two and a half years, taking money in return, was dismissed in July Three months later, victims still had not been notified

The agency said it could not identify the leaked data and victims because an investigation was under way Lawmaker Kim Ki-woong said it was hard to accept delaying notification to victims when there were access records

📜 The notification order set by law

Article 39 of the Enforcement Decree of the Personal Information Protection Act requires notifying data subjects within 72 hours of learning of a leak The allowed reasons for delay are when urgent blocking and recovery measures are needed and unavoidable cases such as natural disasters

Even if the leaked items or timing haven’t all been confirmed, the fact of the leak and what has been confirmed so far must be notified first If contact details are unknown, posting on the website for 30 days or more can stand in for notification

An ongoing investigation is not a reason for delay listed in the decree How the commission will apply this standard in actual penalties has not been settled yet

I covered the 72-hour notice and the possible-leak notice system in a September post

🔗 Link - https://blog.naver.com/rottensweetpotato/224411377067

What to do now

Four steps people affected by public agency leaks should take now Four steps people affected by public agency leaks should take now — Source: self-rendered based on KISA and the Enforcement Decree of the Personal Information Protection Act

When news of a leak comes out, there are cases of text messages impersonating the agency and promising compensation KISA says there is no government-level individual compensation procedure, and agencies do not take damage compensation claims through messengers

You can check suspicious texts with the smishing check service on the KakaoTalk channel Bohonara (보호나라)

🔗 Link - https://privacy.kisa.or.kr

Sources