Luxury Brands Dior, Louis Vuitton, Tiffany Fined $25 Million in South Korea Data Breach
South Korea’s Personal Information Protection Commission (PIPC) Imposes Fines on Luxury Brands
South Korea’s Personal Information Protection Commission (PIPC) has imposed substantial fines on several prominent luxury brands, totaling 36 billion Korean won ($25 million), following a recent data breach incident.
Affected Companies and Fines
The affected companies, Louis Vuitton, Dior, and Tiffany, all owned by the multinational luxury goods conglomerate LVMH, were found to have compromised the personal information of millions of individuals.
- Louis Vuitton received the largest fine, approximately $15 million, due to cybersecurity failures that led to the infection of employee devices with malware. As a result, the personal information of around 3.6 million individuals was compromised.
- Dior was fined around $8.4 million for exposing the information of 1.95 million individuals after an employee fell victim to a voice phishing attack.
- Tiffany was ordered to pay $1.6 million for exposing the details of approximately 4,600 people, also due to a voice phishing attack.
According to the PIPC, the data breaches are linked to a SaaS platform intrusion, although the specific platform was not named. However, it is reported that the incident is connected to a campaign targeting Salesforce customers, which was carried out by the Scattered LAPSUS$ Hunters extortion group.
The Scattered LAPSUS$ Hunters group obtained millions of data records during the campaign, which affected dozens of major organizations, including Louis Vuitton, Dior, and Tiffany. The incident highlights the importance of robust cybersecurity measures and employee education to prevent social engineering attacks.
Conclusion
The PIPC’s fines serve as a reminder to organizations of the importance of protecting personal information and the potential consequences of failing to do so. The incident also underscores the need for companies to implement effective security controls and employee training programs to prevent similar breaches in the future.
About Author
English