South Korea fines Coupang $400M after breach

A record fine against Coupang signals a shift in global privacy enforcement, with regulators willing to apply maximum penalties across borders after insider-driven breaches. For security and IT leaders, this changes how breach risk is modeled. Insider access is now a primary threat vector, and global enforcement is no longer theoretical. At the same time, Shadow AI and developer-targeted malware are expanding how data leaves organizations, often outside traditional controls. We also cover new AI-driven attack delivery methods, Microsoft 365 detection changes, and rising pressure to adopt governed AI tools. Learn more at https://crestvale.io

Transcript

SPEAKER_00 0:00

A single insider breach just triggered one of the largest privacy fines on record, and it did not stay local. Regulators showed they will reach across borders and use the maximum penalty available. This is the Crestvale Newsroom Daily Podcast. South Korea just set a new bar for enforcement. The Personal Information Protection Commission issued a record fine against Koupang after a months-long insider-driven breach exposed data on more than 34 million customers. Names, addresses, phone numbers, and order histories were all accessed. That is roughly two-thirds of the country. The number matters. It lands at over $400 million. But the signal matters more. This was the maximum penalty available, and it was applied to a company headquartered in the United States. That combination changes how you model risk. This was not a zero day. It was access control failure at scale. A former employee retained or regained access and moved through data over time. No single action looked catastrophic. The outcome was. Now connect that to jurisdiction. If you operate in a market, you are exposed to that market's enforcement. Corporate structure does not shield you. Local regulators are willing to act, and they are willing to set precedent. Why this matters? You can no longer anchor breach exposure to U.S. enforcement norms. Global regulators are converging on higher penalties and faster action. At the same time, insider risk is proving it can create national scale incidents without tripping traditional defenses. If your controls assume external attackers first, your model is outdated. Now, attackers are shifting how they get in. Fortinet is tracking campaigns that pose as AI learning resources. Think study guides, code samples, and developer tooling. The lure is curiosity. The execution is quiet. These chains use trusted tools like PowerShell and scheduled tasks. Payloads are assembled in stages and run in memory. Very little ever lands as a clear malicious file. That makes detection harder. Nothing looks dangerous in isolation. The important shift is not the technique, it is the packaging. AI learning content has become a distribution channel. For security teams, this means your training surface is now part of your attack surface. When a developer downloads a guide, they may be executing unvetted code. If your controls focus on binaries and signatures, you will miss this. You need tighter control over scripting engines and better visibility into memory behavior. And you need to treat external AI resources as untrusted inputs by default. Meanwhile, the problem inside Microsoft 365 is not a lack of alerts, it is a lack of context. Enforcer is rolling out a threat detection and response layer built for multi-tenant environments. The idea is simple. Identity alerts without tenant context are noise. They are correlating intra signals with Defender, Purview, Teams, and SharePoint, then evaluating events against actual tenant configuration. A risky sign-in is judged against the policies in place, not in isolation. That changes response quality. It links alerts back to missing controls and misconfigurations. And it gives operators a direct path from incident to policy fix. If you run M365 at scale, this is where tools are heading. Fewer raw alerts, more context tied to how your tenant is actually configured. And then there is shadow AI. PagerDuty's latest data makes this concrete. 88% of employees report sharing work-related information with public AI tools. That includes customer data and internal documents. Two-thirds say they use tools they believed were not allowed. This is not edge behavior. It is the default. At the same time, three-quarters of respondents say they would consider leaving for better AI access and training, so strict bans are not holding. They are being routed around. For security leaders, this reframes the problem. You do not stop this with policy alone. You replace it with governed options. If you do not provide sanctioned tools with clear data boundaries, your data will continue to leave the building through unsanctioned ones. Here is what else is worth knowing today. Coinbase is giving AI agents wallets and trading authority. Machine identity is moving directly into financial controls. Samsung approved ChatGPT, Claude, and Gemini for internal use. Enterprise AI lockouts are giving way to controlled adoption. Microsoft is pushing automated agent tuning and production. AI behavior is becoming something you continuously adjust, not something you deploy once. Visa is building identity and payment rails for agent-driven commerce. Autonomous transactions are getting closer to real world use. Bain and company found many AI programs are missing ROI targets. Expect tighter governance and more pressure on measurable outcomes. Before we close out, here is a quick look at where markets landed. Equities finished higher in the previous session, with both SPY and QQQ moving up. The 10-year yield edged down. In commodities, gold pushed higher while oil moved lower. Bitcoin also climbed, holding a steady upward trend. Here is the takeaway model insider access and unsanctioned AI use as primary data exfiltration paths, not edge cases. Tomorrow we are watching how enterprises formalize AI access with guardrails as enforcement tightens and agent capabilities expand. If this was useful, follow the Crestvale Newsroom daily podcast so you don't miss it. Thanks for listening.