SEOUL — South Korea’s latest cybersecurity incidents are exposing a growing debate over how the country handles major data breaches — and whether the same standards are being applied consistently to domestic and foreign companies.
In a Korea Times opinion column, cybersecurity expert Bryan Cunningham argues that Seoul’s response to the recent Tving breach demonstrates that South Korea can conduct serious cyber investigations in a professional and measured way. His concern, however, is that the approach has differed sharply in the case of U.S.-listed e-commerce giant Coupang.
The argument comes as South Korea faces a series of high-profile data-security incidents involving millions of users.
Tving Breach Puts Nearly 40 Million Accounts in Focus
A joint government-civilian investigation found that 39.54 million Tving accounts were compromised in a hacking incident. Investigators also identified the theft of 361 development projects containing source code and found that attackers obtained access keys that enabled them to penetrate the streaming platform’s systems.
The investigation found that exposed information included names, dates of birth, phone numbers and email addresses, among other categories of personal data.
South Korean authorities said they had not detected confirmed cases of secondary harm or evidence that the stolen information had been traded on the dark web at the time of the investigation. Tving was also found to have failed to report the incident within the required 24-hour period.
Cunningham describes the government’s handling of the Tving case as an example of what he considers an appropriate regulatory response.
Why Coupang Became the Bigger Flashpoint
The controversy becomes more complicated when compared with the regulatory action against Coupang.
South Korea’s Personal Information Protection Commission imposed a combined 624.7 billion won penalty on Coupang in June over a major data breach and unauthorized collection of online activity records. The breach itself affected more than 37 million users, according to Yonhap.
Coupang has disputed aspects of the regulator’s findings and said it planned to pursue legal action.
Cunningham argues that the size and intensity of the response should be examined alongside penalties imposed in other major Korean data-security cases.
He points specifically to Kakao Pay and SK Telecom, arguing that the differences in penalties raise questions about proportionality and consistency. These comparisons are part of Cunningham’s opinion rather than an official government finding that regulators discriminated against Coupang.
The Numbers Are Driving the Debate
The Coupang penalty was more than four times the 134.8 billion won fine previously imposed on SK Telecom following its major 2025 data breach involving millions of subscribers.
That contrast has already generated a broader debate over whether privacy penalties should be determined primarily by the number of affected users, the nature of the security failure, the sensitivity of the information, corporate conduct, or other factors.
For Cunningham, the issue is not whether companies should be held accountable for protecting personal information. Instead, he argues that consistent enforcement matters just as much as strict enforcement.
A Government Breach Adds Another Layer
The column also points to a separate cybersecurity incident involving South Korea’s Ministry of Foreign Affairs.
According to Cunningham, hackers remained inside the Korea National Diplomatic Academy’s systems from April 2025 until February 2026, accessing information connected to current and former diplomats. He argues that the government’s handling of that incident raises additional questions about transparency and accountability.
These claims should be understood in the context of the column’s argument: Cunningham uses the incidents to make the case that cybersecurity rules should be applied consistently regardless of whether the affected organization is Korean or foreign.
Why This Matters Beyond Coupang
The dispute is bigger than one company or one privacy penalty.
South Korea and the United States increasingly depend on one another for cybersecurity cooperation, particularly as governments confront sophisticated cyber threats from multiple countries.
Cunningham argues that inconsistent enforcement could undermine confidence between allies and create friction for companies operating across borders. He also warns that escalating regulatory disputes could eventually spill into broader economic relations.
At the same time, South Korea has a legitimate interest in protecting its citizens’ personal information and ensuring that companies operating in the country meet its privacy and cybersecurity requirements.
The central question, therefore, is not simply whether regulators should impose tough penalties.
It is whether the same principles are being applied consistently across comparable cases.
As South Korea confronts another wave of major data breaches, that question could become increasingly important — not only for Korean consumers and companies, but also for Seoul’s growing digital and economic ties with the United States.
WWC ONE MEDIA G,A
