South Korea’s Duo Faces Backlash Over $810K Fine for Massive Data Breach South Korea’s largest matchmaking company, Duo, has been fined 1.2 billion won ($810,000) by the Personal Information Protection Commission (PIPC) for a 2023 data breach that exposed the personal information of 427,464 members. The incident, which occurred in January 2023, stemmed from a hack of an employee’s work computer, compromising 24 types of sensitive data, including names, residential addresses, email addresses, educational backgrounds, and blood types. Authorities determined that Duo’s security measures were inadequate, citing unrestricted failed authentication attempts leaving the database vulnerable to brute-force attacks and weak encryption for passwords and resident registration numbers. The PIPC also imposed an additional 13.2 million won ($9,600) administrative penalty for the company’s failure to destroy data, report the breach, and notify affected customers promptly. The fine, calculated at 3% of Duo’s average annual revenue (41.3 billion won over three years), was reduced under mitigation provisions for small- and medium-sized enterprises. However, public criticism has mounted, with many arguing the penalty roughly 3,000 won ($2.20) per victim is disproportionate to the breach’s scale. Under upcoming revisions to the Personal Information Protection Act, fines for severe or repeated violations will increase to 10% of revenue starting in September 2024, though Duo’s case was assessed under the previous standard. Duo issued a public apology, stating it had strengthened security measures and confirmed that no secondary damage from the leak has been reported. However, Gangnam District, which oversees the company, plans an on-site inspection next week, with potential additional fines or business suspension pending the findings.