South Korea fines matchmaking firm Duo after major personal data breach

South Korea fines matchmaking firm Duo after major personal data breach
A groom puts a wedding ring on his bride's finger during a wedding ceremony at a budget wedding hall at the National Library of Korea in Seoul, South Korea, May 16, 2015. REUTERS
Reuters

SoutSouth Korea’s national data protection agency said on Thursday it had imposed a significant fine on matchmaking service Duo following a cybersecurity failure that led to the leak of highly sensitive personal information.

The compromised data included personal details often required in the South Korean dating market, such as weight, blood type and marital history.

The Personal Information Protection Commission (PIPC) said Duo failed to implement adequate security measures to protect its membership database. It also found the company was slow to respond after hackers breached its systems last year.

The regulator fined Duo 1.21 billion won (£665,000) and ordered it to take immediate corrective action. The company must overhaul its data protection systems and fully disclose technical details of the breach to affected users.

A treasure trove for identity thieves

The scale of the breach is significant, given the sensitive nature of the data involved. Hackers gained unauthorised access to Duo’s main database in January last year and downloaded personal information belonging to more than 420,000 current and former members.

In addition to dating-related details, the stolen data included mobile phone numbers, home addresses, university histories and places of work.

The PIPC warned that such information could be used for identity theft, targeted phishing or social extortion.

The investigation also found Duo had breached data retention laws. The company stored highly sensitive information, including 13-digit national identification numbers and passwords, in violation of regulations.

It also failed to delete the dormant data of nearly 300,000 former users, despite a legal requirement to remove such information after five years.

Cultural reliance and corporate response

The breach has raised concerns due to Duo’s prominent role in South Korean society. The company is one of the country’s best-known matchmaking services, operating in a culture where many people rely on professional agencies to find partners based on detailed socio-economic and personal criteria.

According to its website, Duo has facilitated more than 53,000 marriages and claims an average of seven couples marry each day through its service. It currently reports around 36,000 paying members.

In response to the ruling, the company issued a public apology. In a statement, Duo said it respected the regulator’s findings and “deeply regrets that we failed to adequately protect our members’ personal data.”

However, it said the breach resulted from a sophisticated “hacking attack that was extremely difficult to detect or prevent”, rather than negligence.

The incident is the latest in a series of major data breaches in South Korea. In recent years, companies across sectors, including e-commerce and telecommunications, have suffered similar incidents due to both cyber attacks and internal misconduct.

The growing number of breaches has prompted public concern and led the government to strengthen enforcement, signalling a tougher approach to data protection.

Tags