KR Data Watch journal

What Korea’s breach record is telling us.

Recent cases, explained without alarmism. Every story starts with primary Korean regulator material and ends with the question that matters for people affected.

Retail · September 2026

1.66M

Credential stuffing

GS25 · GS SHOP · South Korea

1.66 million accounts. One reused-password problem.

The GS Retail case is a reminder that a breach does not always begin with a dramatic break-in. Sometimes attackers simply try passwords that have already leaked somewhere else.

4 min readRead article

Telecom · August 2026

72h

Evidence preservation

KT · LG U+ · South Korea

When the logs disappear, the breach gets harder to see.

South Korea’s latest telecom decisions make one point unusually clear: security logs are not a technical afterthought. They are the evidence that tells customers what happened.

5 min readRead article

Data brief · May 2026

447

2025 in review

PIPC · KISA · South Korea

447 breach reports: Korea’s year of ransomware, weak access and repeat mistakes.

The headline is not one company. It is a pattern: reported personal-data breaches in Korea jumped sharply in 2025, and hacking was the largest reported cause.

4 min readRead article

Platform safety · September 2026

422K

Scope matters

Weverse Company · South Korea

An account ID is not harmless just because it is not a name.

Weverse said 422,584 internal account IDs and purchase metadata were exposed. Its notice also drew an important boundary: the reported scope did not include names or contact details.

4 min readRead article

Healthcare · September 2026

219K

Sensitive context

Gangnam Unni / Healing Paper · South Korea

Health-service data needs a different kind of breach response.

The Gangnam Unni record involves more than an account reset: reported data categories include consultation and treatment information, with payment information for some users.

5 min readRead article

Editorial standards · September 2026

72h

Evidence status

South Korea incident reporting

“Under investigation” is information — not a blank space.

Early breach reports can be the moment when people most need to protect themselves. They are also when facts are easiest to overstate. The answer is a visible status, not silence.

4 min readRead article