Korea's privacy regulator has fined GS Retail (KRX:007070) 12.8 billion won due to a personal data leak, according to a statement on Monday.

An unknown attacker repeatedly tried pre-secured user IDs and passwords to bypass login systems of home shopping platform GS SHOP between 2024 and 2025, the Personal Information Protection Commission (PIPC) said.

The hacker accessed personal data on 1.6 million GS SHOP users and 79.1 million customers, exposing information such as names, birth dates and phone numbers.

The retail giant failed to monitor unusual signs, leading to the breach being undetected for an extended period, the privacy watchdog said.

The company was also missing a privacy protection office during the attacks, according to PIPC.

The regulator ordered the company to pursue corrective measures, including efforts to prevent recurrence.