Personal data breach reports surge to 579

a room with a table and chairs — Maciej Drążkiewicz / Unsplash

This year, personal data breach reports have surpassed last year's total within just eight months, with 579 reports filed from January to August. Among these, only 33 cases had on-site investigations conducted by the Personal Information Protection Commission by the end of September, indicating a low investigation rate of 5.7%. This situation raises concerns regarding the adequacy of initial responses and investigation measures in light of the surge in reports.

The number of reports filed from January to August has increased by 132, or 29.5%, compared to last year's annual total of 447. Reports related to breaches due to hacking in private enterprises also reached 199 in the first half of this year, which is 85.8% of last year's total of 232. However, it is important to differentiate between the overall breach reports and those linked to private enterprise hacking, as the timeframes and reporting categories differ.

A lawmaker has emphasized the need for timely on-site investigations and preventive measures, especially in high-risk sectors such as finance, to prevent further spread of damage. The commission stated that it first verifies the scale and circumstances of breaches through written inquiries before determining the necessity for on-site investigations.

Consequently, it is not accurate to label all 546 cases without on-site investigations as neglected or unexamined. The investigation rate serves as a measure of investigation methodology rather than indicating the overall initiation or completion rates for all cases. The current data does not clarify the status of written inquiries or the time taken from reporting to initial actions taken on these cases.

To properly assess the adequacy of responses, it is essential to examine the number of on-site investigations, the timing of case initiation, emergency measures taken, and the criteria for selecting cases for investigation. While the statistics indicate a need for a review of the investigation system due to the increase in reports, one cannot conclude that the failure in initial responses is solely based on the investigation rate.