Personal Information Protection Commission Launches Investigation into Personal Data Leak in 'Open Chat Rooms'

The Personal Information Protection Commission announced on the 14th that it has launched an investigation into the leakage of personal information from KakaoTalk open chat rooms.

The Commission plans to investigate whether there have been violations of the 'Personal Information Protection Act' regarding security vulnerabilities in KakaoTalk open chat rooms, the circumstances and scale of the personal information leakage, and technical and managerial protective measures.

Previously, advertisements claiming to extract and sell participants' real names and phone numbers from KakaoTalk open chat rooms were posted on online sites, sparking controversy.

The advertising company claimed, "It is possible to extract the entire database from any open chat room," and stated, "Real names, phone numbers, and all open chat room data are available. We filter out advertising accounts, ghost accounts, and overseas numbers."

They promote that by exploiting KakaoTalk's security vulnerabilities, they extract participants' serial numbers (identification IDs) from open chat rooms and then obtain personal information from KakaoTalk accounts. There is also a possibility that this company is generating criminal profits in marketing and advertising by using personal information as bait.

In response, Kakao stated, "It is impossible to verify phone numbers, emails, or conversation contents," and announced a strong response against the company.

A Kakao representative explained, "We took action against the chat rooms and abusers immediately after recognizing the abusive behavior (user ID extraction process). However, it is impossible to confirm participants' phone numbers, emails, or conversation contents within open chat rooms, so we believe other methods outside of open chat were used."

They added, "The company's actions are prohibited by terms and conditions and by law. We plan to report to investigative agencies and take legal action; the report to KISA has been completed. If investigations by relevant authorities take place, we will cooperate sincerely to ensure users can feel secure."