As of September 2026, there are 175 cases of personal information breaches that have been under investigation for over a year. Concerns have been raised that the focus on major data breaches is delaying the handling of regular cases.
According to data submitted by the Personal Information Protection Commission (PIPC) to Park Hong-bae, a member of the National Assembly from the Democratic Party, 175 cases have not been resolved more than a year after investigations began. Among these, 30 cases have been pending for over two years.
The reported scale of data breaches for unresolved cases includes 14,335,000 records for those pending over a year and 1,444,000 records for those pending over two years. However, these figures are based on initial reports, and the actual scale may change during the investigation.
According to PIPC regulations, results must be reported within six months of the investigation's start. For complex cases requiring specialized knowledge, the deadline is extended to 12 months, with further extensions possible upon separate reporting.
The PIPC explained that the delays in processing cases are due to an increase in breach reports and the prioritization of major incidents, which has resulted in delays for regular cases.
Indeed, a report from the National Assembly Budget Office indicated that the investigation and resolution of the SK Telecom data breach took 127 days, while the Coupang data breach took 201 days. As significant time is invested in investigating and resolving major cases, there is also a need to address the backlog of long-pending cases.
Park stated, "Victims of regular cases should not be left waiting indefinitely for investigation results," and emphasized the need for a concrete plan to secure necessary personnel and timelines for resolving long-pending cases, ensuring that there are no gaps in preventing further harm and supporting victims during investigations.
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.