Reports rose 45.6% in one year.
PIPC and KISA recorded 447 personal-data breach reports in 2025, up from 307 in 2024. Hacking accounted for 276 cases, or 62% of the total. The statistics do not mean every report became a confirmed breach of the same scale; they show the volume of incidents that required a formal response.
That distinction is central to KR Data Watch. A report, a regulator investigation, and a final sanction are different stages of the public record — each is worth showing, but each needs its own label.
Ransomware was part of the pattern.
Among hacking-related reports, PIPC identified malicious software such as ransomware and web shells in 96 cases. Exploited web weaknesses, including SQL injection and parameter manipulation, appeared in 32 cases. Abnormal access to administrator pages was also a named category.
In June 2025, PIPC opened an investigation into YES24 after the company reported a ransomware attack and suspicious access to member information. At that point, the regulator said the scale and circumstances were still being examined — a useful example of why “investigating” is a meaningful status, not an empty holding label.
The practical read on the numbers.
Big incident totals are attention-grabbing, but people need two additional questions answered: what data was involved, and who confirmed it? A phone number and a payment record do not create the same risk. A company announcement and a regulator decision do not carry the same evidentiary weight.
The job of a public index is to keep those differences visible — before an incident is forgotten, and before an unverified claim is mistaken for a fact.