South Korea sharply stiffened penalties for major data breaches by raising maximum fines to 10 percent of a company’s annual revenue for incidents caused by intent or gross negligence that expose the personal data of 10 million or more people. The revised Personal Information Protection Act also requires companies to notify affected individuals within 72 hours when there is a high likelihood of exposure, even if a leak hasn’t been confirmed, and expands reporting obligations to include data altered or damaged by ransomware. The enforcement decree targets repeat offenders (within three years) and entities that ignore corrective orders, with fines determined by the violation’s nature, severity and damage scale; the previous cap had been 3 percent of sales.
Mitigating factors can reduce penalties: firms that demonstrate sustained investment in data protection or that detect, report and contain breaches promptly can receive up to 40 percent reductions. The rules bolster the role and oversight of chief privacy officers at large data processors (companies with revenue over 180 billion won handling data on 1 million+ people or sensitive data on 50,000+), requiring board sign-off and PIPC notification for CPO appointments or dismissals. Regulators signal the change is designed to reframe data protection as a proactive investment in trust and business resilience rather than a routine cost.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
The SR-71 Blackbird's ancient navigation technology, known as 'R2-D2,' could become crucial for military operations in GPS-denied environments. This method, used historically, is being revisited to enhance future combat capabilities. (twz.com)
More U.S. military deaths during the Iran conflict have not been fully disclosed by the Pentagon. The actual number of casualties is higher than publicly reported. (washingtonpost.com)
Hackers exploited Anthropic's AI model, Claude, to gain unauthorized access to OpenAI's systems. The breach highlights risks in using AI models for security-sensitive operations. (wsj.com)
Linguistic illegibility refers to situations where an LLM's internal computations are not accurately reflected in its language output or probes. Security measures relying on linguistic self-reporting are therefore insufficient, and alternative techniques like taint tracking and sandboxing are necessary to ensure safety. (arxiv.org)
Classified stealth parts of F-35 fighter jets were diverted to Hong Kong by a shipper and have gone missing. The incident raises concerns about security and potential unauthorized access to sensitive military technology. (politico.com)
Google's threat intelligence group infiltrated the notorious supply-chain hacking gang TeamPCP, allowing them to monitor and disrupt the group's activities. An undercover Mandiant analyst built trust within the group, providing critical intelligence that helped law enforcement arrest two alleged members. (wired.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.