Data breach fines: Korea vs Japan, the US and Australia

Same size, different outcome

People affected as each company or regulator reported them. Korean won are converted at ₩1,500 = US$1 for a rough comparison only. "None found" means we searched the regulator's own enforcement list on 10 November 2026.

Same attack wave, fined only in Korea

In 2025 attackers tricked staff and support desks into giving access to the cloud customer databases of Louis Vuitton, Dior and Tiffany. Korea's PIPC fined their Korean units ₩36 billion in February 2026 and said a company stays responsible for security when it keeps customer data in a SaaS product.

• Louis Vuitton in Türkiye: 142,995 people. The KVKK published the breach notice; we found no penalty decision.
• Louis Vuitton UK, Dior and Tiffany in the UK: no entry in the ICO's enforcement list. Louis Vuitton and Dior in the US: no FTC case; class actions only. France: no matching CNIL sanction.
• Tiffany in the US and Canada (about 2,500 people): Canada's privacy commissioner said it was reviewing the report. Tiffany Korea (4,600 people) was fined ₩2.4 billion.
• Qantas fell to a social engineering attack on an overseas third-party provider in the same period. The OAIC found no likely failure to take reasonable steps and took no action. Press reports tie these attacks to the same group; regulators have not said so.

Why the gap

• Korea: the PIPC can fine up to 3% of total revenue for failing to protect data, and up to 10% for repeat, intentional or grossly negligent cases from 11 September 2026. It fines the security failure itself, not only misuse.
• Japan: the Personal Information Protection Commission can give guidance, a recommendation or an order, but cannot fine. The 2026 amendment adds a surcharge from July 2028 at the latest, only for illegally using, obtaining or passing on data for money. A leak caused by poor security (Article 23) is not covered.
• United States: there is no national breach fine. The FTC said in its 2024 Marriott order (344 million customers) that it had no legal authority to obtain civil penalties in that case; Marriott paid US$52M to state attorneys general instead. Money comes from states, the SEC for misleading investors, or sector regulators such as HHS and the FCC.
• Australia: penalties can reach A$50 million or 30% of turnover, and the first civil penalty came in October 2025 (A$5.8M, Australian Clinical Labs). Cases against Optus and Medibank, both from 2022, are still in court.
• UK and EU: the ICO and the CNIL do fine for breaches, as Capita, Free and 23andMe (£2.31M for 155,592 UK users) show.

What this means if your data leaked

• A fine goes to the government, not to you. Compensation comes from the company's own offer, a class action or a claim in court; see compensation by country.
• US: check our open settlements for claim deadlines, and keep the breach letter.
• Japan: there is no statutory compensation; companies usually offer an apology payment or vouchers. Watch the company's notice.
• Anywhere: change reused passwords first, and never pay a fee to someone offering to claim for you.

Facts gathered from regulator pages and news reports up to 10 November 2026. Several cases (Nitori, Change Healthcare, Latitude) are still open and may end in a penalty later. General information, not legal advice.