Microsoft, Naver subsidiary, four others fined for data leaks

South Korea's Personal Information Protection Commission (PIPC) slapped penalties, penalty surcharges, and administrative fines on Microsoft, Kakao blockchain subsidiary Ground X, and four other entities for failing to protect clients' personal information.

The four others were software company Innovation Academy, the Korea Professional Football League, the Korea Mountainbike Federation, and the World MathFusion Olympiad Korea.

The penalties amounted to 84.4 million won, penalty surcharges to 53.4 million won, and administrative fines to 31 million won.

The personal information was leaked through hacking or employee mistakes.

Microsoft was said to have failed to take protective measures for its personal information processing system administrator account, resulting in a global leak of 119,432 Outlook email accounts, including 144 from South Korea.

Personal information leaks and user notifications were also delayed, according to the PIPC.
While Microsoft notified its users in English about the information leaks within 24 hours, the notice in Korean was delayed by 11 days and it was concluded after a legal review that users should be notified in Korean, according to the PIPC.

A fine of 13 million won and a penalty surcharge of 3.4 million won was also imposed on Microsoft.

Ground X, who was found negligent in protecting passwords, was assessed a fine of 6 million won and a penalty surcharge of 25 million won.

Innovation Academy, which leaked clients' resident registration numbers, was slapped with a fine of 3 million won and a penalty surcharge of 25 million won.