Overview
- Duo, which was sanctioned Thursday by South Korea’s Personal Information Protection Commission, must pay about 1.2 billion won plus a separate 13.2 million won fine and obey corrective orders.
- The regulator said hackers accessed records for roughly 420,000 to 430,000 members, including names, addresses, phone numbers, resident ID numbers, encrypted passwords, and profile details such as height, weight, religion, blood type, education, work history, and marital history.
- Investigators traced the breach to January 2025 after malware hit an employee’s work PC, letting the attacker steal database credentials and download member data, followed by a three‑day delay in notifying authorities.
- The commission found basic safeguards missing, including limits after repeated login failures, insecure encryption for resident ID numbers and passwords, collection of ID numbers without a legal basis, failure to delete 298,566 records older than five years, and no prompt user notice.
- Orders require immediate notice to affected members, stronger access controls, a review to collect only data needed for the service, clearer deletion rules, and a public disclosure of the penalties on Duo’s website, as officials intensify enforcement after a run of high‑profile breaches.