South Korea Fines Luxury Brands $24.9M for Major Data Breaches South Korea’s Personal Information Protection Commission (PIPC) has imposed a combined 36 billion won ($24.9 million) in fines on the Korean subsidiaries of Louis Vuitton, Dior, and Tiffany for failing to protect customer data from cyberattacks. Louis Vuitton Korea received the largest penalty 21.4 billion won after hackers breached its systems on three occasions, exposing the personal data of 3.6 million customers, including names, phone numbers, and birth dates. The PIPC cited poor security practices for remote logins, which allowed an external actor to compromise an employee device. Christian Dior Couture Korea was fined 12.2 billion won following a breach affecting 1.95 million users, where employees were tricked into granting system access to malicious actors. The company remained unaware of the incident for three months. Meanwhile, Tiffany Korea faced a 2.4 billion won fine after a breach exposed the data of 4,600 customers, including names and email addresses. In a separate case, the PIPC penalized BKR (Burger King Korea) 924 million won for illegally collecting personal data from minors under 13 without guardian consent. MGC Global (Mega MGC Coffee) was fined 642 million won for sending unsolicited marketing messages to customers who had not opted in. Additionally, eight other food and beverage companies were fined for violating data protection laws. The penalties highlight growing regulatory scrutiny over corporate data security and compliance with South Korea’s privacy laws.

On or around May 12, 2025, Tiffany & Co., a luxury jewelry retailer, suffered a cybersecurity breach after a threat actor ('Market Exchange') infiltrated its systems. The attack exposed personally identifiable information (PII) of at least 2,590 confirmed individuals, including names, addresses, emails, phone numbers, sales transactions, client reference numbers, and Tiffany gift card details (with PINs). The actor later claimed possession of a broader database containing records of ~720,000 high-spending U.S. customers, predominantly women. The breach was disclosed to authorities and affected individuals in September 2025, with notifications sent via mail. While no financial fraud was immediately reported, the exposure of gift card PINs and detailed customer profiles poses risks of identity theft, phishing, and unauthorized transactions. Tiffany & Co. engaged cybersecurity experts and law enforcement but did not confirm whether ransomware or additional system compromises (e.g., operational disruption) occurred. The incident highlights vulnerabilities in customer data protection within high-end retail.

South Korea Fines Luxury Brands $24.9 Million Over Data Breaches South Korea’s privacy regulator has levied fines totaling 36 billion won ($24.9 million) against the Korean subsidiaries of Louis Vuitton, Dior, and Tiffany following separate data breaches that exposed millions of customers’ personal information. The penalties stem from investigations confirming unauthorized access to sensitive customer data, though specific details on the breaches’ scope and timing remain undisclosed. The fines highlight growing regulatory scrutiny over data protection in South Korea, where authorities are enforcing stricter compliance with privacy laws. The incident underscores the financial and reputational risks for global brands handling large-scale consumer data. In related cybersecurity developments, Japan Airlines reported that up to 28,000 customers were affected by unauthorized access to its baggage service system, while Volvo Group disclosed that 16,991 employees were impacted as part of a broader Conduent data breach, which has now exposed 25 million individuals. These incidents reflect the escalating threat landscape for both corporate and personal data security.