Data Breach
Overview
Data Breach (정보유출, 情報流出) refers to a security incident in which confidential data such as personal information, trade secrets, and technical materials possessed or managed by an organization or individual is taken outside and falls beyond control due to hacking, insider leaks, misconfiguration, physical loss, etc. It is treated as a complex risk that causes direct harm to corporate credibility, national security, and individual privacy, going beyond a simple hacking incident. Recently, with the spread of cloud and generative AI, leak paths have diversified, establishing it as an area where technical controls and legal regulations must be designed together.
Key Details
Definition and Scope
Data breaches are defined from three broad perspectives. First, from a legal perspective, it means an incident involving loss, theft, leakage, forgery, alteration, or destruction of personal information under the Personal Information Protection Act (개인정보 보호법). Second, from a technical perspective, it refers to an event in which an unauthorized party accesses, copies, or transmits data. Third, from a managerial perspective, it indicates a state in which an organization's core assets have left its control, damaging competitive advantage or trust capital. Therefore, the same incident may be defined differently by regulators, security teams, and management.
Types and Paths
Leak paths are divided into external intrusions and internal factors. External intrusion types typically include ransomware, supply chain attacks, vulnerability exploits, and account takeover through phishing/smishing. Internal factor types include data exfiltration by employees planning to leave, misuse of privileges, and accidental public configuration (unauthenticated exposure of cloud storage or databases). Other major paths include loss of physical media, secondary leaks via partner companies, and resale on the dark web. In actual incidents, most cases involve multiple paths combined in a chain.
Structure of Damage Propagation
Even if leaked data is not immediately exploited, it is reused over the long term. Personal information becomes material for voice phishing, account takeover, and identity theft, while corporate secrets are converted into leaked information to competitors or bargaining material. In particular, because of the practice of using the same password across multiple services, a single leak frequently leads to credential stuffing, causing cascading login incidents. The scale of damage varies greatly depending not only on the number of leaked records but also on the sensitivity of the data, whether it was encrypted, and the time taken to detect the breach.
Legal Regulation and Responsibility
In Korea, the Personal Information Protection Act, the Information and Communications Network Act (정보통신망법), and the Credit Information Use and Protection Act (신용정보법) stipulate breach notification duties and standards for fines and penalties. If a breach above a certain scale occurs, data subjects and regulators must be notified, and violations may result in fines calculated as a percentage of revenue. The EU's GDPR established an international standard by requiring notification within 72 hours and fines of up to 4% of global revenue, while the United States has a mix of state laws and sector-specific regulations. Recently, discussions of class-action lawsuits for personal information and punitive damages have been expanding.
Technical and Managerial Responses
Technical responses include data encryption, access control and least privilege, multi-factor authentication (MFA), data loss prevention (DLP) solutions, user and entity behavior analytics (UEBA), and adoption of zero trust architecture. Managerial responses include asset identification and classification, regular privilege reviews, offboarding procedures for departing employees, supply chain security assessments, and security training for employees. After an incident, the typical response sequence is isolation/blocking, forensic analysis, reporting and notification, victim remediation, and establishment of recurrence prevention measures.
Latest Trends
The key changes in the data breach environment in 2024–2025 are the industrialization of attacks and strengthened regulation. Ransomware groups have standardized "double extortion," in which they do not stop at encrypting data but use the leak itself as a means of blackmail, and with attacks becoming specialized through RaaS (Ransomware-as-a-Service), barriers to entry have lowered. Supply chain attacks and exploitation of zero-day vulnerabilities have increased, and there are more cases where organizations are compromised through partners even when their own security is robust.
The spread of generative AI is also a new variable. Incidents in which employees input work materials into external AI services and confidential information flows into training data, internal data theft through prompt injection, and leakage of AI model weights or training data itself have emerged as new types. Accordingly, companies are introducing internal dedicated AI gateways, data masking, and input logging policies.
On the regulatory side, both domestically and internationally, the trend is toward strengthening preventive obligations. Risk-based approaches, privacy impact assessments, controls on cross-border transfers, and requirements to prove the legality of AI training data are expanding, and securities market rules requiring disclosure of breach incidents are also being reorganized. Technologically, zero trust, confidential computing, homomorphic encryption, and immutable records of data access history (blockchain-based audit logs) are drawing attention as next-generation response measures.
Ultimately, the direction of data breach response is shifting from "post-incident response" to "shortening detection time and minimizing damage." Since it is realistically difficult to prevent 100% of incidents, awareness is spreading that organizations that make early detection, rapid containment, transparent disclosure, and trust recovery their core capabilities will survive in the long term.
Related Topics
- [[Personal Information Protection Act]]
- [[Ransomware]]
- [[Zero Trust]]
- [[Cybersecurity]]
- [[GDPR]]
- [[Supply Chain Attack]]