Allies need cooperation on data security, not double standards
Bryan Cunningham
The Korean government recently announced the results of their investigation into the hacking of streaming platform Tving. The investigation appears thorough, and the findings are grave.
Unidentified hackers stole access keys and compromised highly sensitive information of 39.54 million individuals, along with source code and other technical assets and, crucially, moved these secrets overseas, with the attackers and their country of origin still not identified.
The Tving breach included up to 70 types of personal information across 20 categories, including phone numbers, email addresses, dates of birth, and payment histories. Tving missed the 24-hour breach notification requirement and investigators warned the stolen data could fuel further phishing attacks and data theft.
By all accounts, the South Korean government’s response – a technical briefing, clear set of findings, company apology, and a referral to the Personal Information Protection Commission (PIPC) to weigh penalties in due course – was measured, professional, and proportionate, though with no penalties to date.
Over my two decades in cybersecurity and data protection, starting in the post-9/11 White House, I have seen governments make enforcement mistakes, being too lenient on the one hand and unfairly harsh on the other, including for inappropriate reasons.
Tving was handled correctly. My concern is the Korean government’s apparent double standard applied to an American company. Korean officials have demonstrated they can handle even a severe foreign attack appropriately, with fairness and professionalism. That was not the case with the far less significant late 2025 Coupang breach.
The Coupang incident involved an insider – a former employee who used his access over several months in 2025 to steal names, email and physical addresses, telephone numbers, and order information of Coupang users – but no passwords, no payment or financial data, and no government IDs. The insider confessed, cooperated, and surrendered his devices.
Forensic analysis concluded the insider downloaded roughly 3,000 records (a figure the ROK disputes but has failed to disprove), all of which he deleted. Moreover, after nearly a year of nationwide monitoring, there is zero evidence that any of the information was used or transferred to third parties, overseas or otherwise.
The PIPC imposed a record ₩624.7 billion in penalties against Coupang. According to an investigative report by the U.S. House Judiciary Committee, more than 10 Korean agencies opened dozens of unrelated investigations against the American company. National Assembly members called for the company to be bankrupted and the government threatened Coupang officials, including American citizens, with criminal charges.
Now set that against two recent cases involving Korean companies. Kakao Pay sent credit and transaction data on 40.45 million users to China’s Alipay without consent, over six years and by deliberate corporate decision. Its penalty was ₩5.97 billion – under 1 percent of what Coupang was ordered to pay. SK Telecom lost the data of 23 million subscribers, including the authentication keys that make dangerous SIM cloning possible; its ₩134.8 billion fine came to roughly one-fifth of Coupang’s.
The lightest penalty of the three went to the company that shipped Korean financial data to China on purpose. The heaviest, by a factor of more than 100, went to the American company whose insider took a few thousand records that were recovered before anyone was harmed.
Then there is the breach the Korean government kept to itself. Hackers sat inside the Ministry of Foreign Affairs’ own Korea National Diplomatic Academy from April 2025 until February 2026, taking names, positions, and email addresses covering essentially the entire current and former diplomatic corps – an intrusion into Korea’s diplomatic – and likely intelligence - capabilities that is a direct threat to Korea’s national security.
That breach went undetected for 10 months, and the government did not disclose it for another five. No hearings, no raids, no penalties, and no official disciplined.
This double standard harms both Koreans and Americans. It pushes Korean consumers toward platforms with weaker security and less accountability, many of them Chinese, at the very moment Seoul says it wants to reduce that dependence.
It invites similar treatment of Korean companies abroad. And it corrodes vital cyber cooperation between Seoul and Washington against North Korea, China, Russia, and Iran – actual enemies – and could trigger a cyber trade war that, like all trade wars, will make everyone less prosperous.
Korea knows how to do this right. It should do so in all cases.
Bryan Cunningham served as deputy legal adviser to the National Security Council under Condoleezza Rice and as a career CIA officer and U.S. federal prosecutor. He played a key role in drafting the Homeland Security Act and related legislation and advised the president and National Security Council on matters of cyber and national security. Cunningham is the principal author of legal and ethics chapters in authoritative cybersecurity textbooks and founded the University of California, Irvine’s Cybersecurity Policy & Research Institute, where he served as Executive Director. He was also a founding vice-chair of the American Bar Association’s Cyber Security Privacy Task Force and has served on expert committees for the National Academy of Sciences, the Markle Foundation, and the Bipartisan Policy Center.