Compliance Radar
Who was sanctioned, and for what?
Fines, court rulings and incidents from Europe, North America, Latin America, Asia-Pacific, Middle East and Africa: 2,207 cases from 44 jurisdictions, each with an official source and checked against that source before publication. Filter by country, area of law and sector. Click a chart to drill down one level.
Click a bar to drill down one level.
Where?
by authority- Personal Information Protection Commission (PIPC, 개인정보보호위원회) €5.12m 100 % · 1 case
What for?
by area of lawAll areas of law
Who?
by company- Anonymised companies €5.12m 100 % · 1 case
When?
per year, by date of decision| Period | Cases | Total |
|---|---|---|
| 2024 | 1 | €5.12m |
| 2025 | 0 | – |
| 2026 | 0 | – |
1 case
8 May 2024 a Korean golf simulator companyGolf simulator company: 7.51 billion KRW after ransomware attack on open file server €5.12m
Attackers obtained the company's VPN credentials, including an administrator account, accessed a file server open to all employees and exposed data on more than 2.21 million customers and employees on the dark web, including 5,831 resident registration numbers stored unencrypted. For inadequate security measures, missing encryption and failure to delete data no longer needed on around 380,000 people, the authority imposed a penalty surcharge of 7,504,000,000 KRW and an administrative fine of 5,400,000 KRW (7,509,400,000 KRW in total). It also ordered a revised internal data protection management, a stronger role for the chief privacy officer and regular data protection training for all employees.
File servers holding customer and staff data must not be open to every employee via a simple VPN login; access must be restricted and reviewed regularly.
Remote access, VPN accounts and open file shares
Missing or inadequate training played a role in the decision.
- Authority / court
- Personal Information Protection Commission (PIPC, 개인정보보호위원회)
- Area of law
- Data protection · Data breaches and data security
- Legal basis
- Personal Information Protection Act (개인정보 보호법) Art. 29, Art. 24-2(2), Art. 21(1); Sanktion nach Art. 64-2(1) Nr. 9
- Action
- Fine
- Status of proceedings
- unknown
- Sector
- Other
- Mitigating circumstances
- Reduction of 30% because no benefit was derived from the infringement and a further 30% for cooperation with the investigation; increase of 50% because the infringement lasted more than two years (August 2020 to November 2023).
- Liability of senior managers
- The company was ordered to strengthen the standing and role of its chief privacy officer (CPO).
- Published
- 9 May 2024
Original amount 7,509,400,000 KRW, converted at the ECB reference rate of 8 May 2024.
Checked against the official source on 8 Oct 2026 · Company name anonymised since 8 May 2026 · Direct link