South Korean police searched the headquarters of KakaoPay (KRX: 377300), the country's largest mobile-payment platform and an affiliate of messaging giant Kakao Corp, over two days on July 6–7, escalating a data-privacy case from the regulatory arena into a criminal one. The Anti-Corruption and Economic Crime Investigation Unit of the Gyeonggi Nambu Provincial Police Agency (the police force for southern Gyeonggi province) executed the warrant at KakaoPay's Bundang, Seongnam office to seize digital records tied to the company's decision to hand customer data to China's Alipay, according to Chosun Biz and Yonhap.
The raid is the first compulsory-search action since police opened the case in March 2026 on a referral from the FSS (Financial Supervisory Service, Korea's financial regulator), Chosun Biz reported. KakaoPay is accused of violating the Credit Information Act and the Electronic Financial Transactions Act. Police have booked both KakaoPay as a corporation and unnamed executives and staff as suspects, and plan to interview witnesses and the accused once the seized material is analyzed, per Chosun Biz.
The awkward part: the data went to a major shareholder
The question a global investor asks first is not whether the fines are large — they are trivially small — but how damaging the escalation and the optics are. And the optics are unusual. The recipient of the data, Alipay, is the payments arm of China's Ant Group and, through Alipay Singapore Holdings, KakaoPay's second-largest shareholder with a roughly 32% stake, according to KED Global. In other words, KakaoPay is under criminal investigation for transferring 40 million customers' personal data — without their consent — to a company that sits on its own cap table.
By the FSS's accounting, KakaoPay passed 54.2 billion records of personal credit information covering a cumulative 40.45 million people to Alipay between April 27, 2018 and May 21, 2024, including encrypted phone numbers, email addresses and account balances (Seoul Economic Daily). The stated purpose was to build a "NSF score" — an Apple metric, outsourced to Alipay, that gauges the likelihood a user's payment funds fall short — for Apple's services, per Chosun Biz. KakaoPay has maintained the transfer was a lawful, contracted data-processing arrangement.
The money at stake is reputational, not regulatory
The fines levied so far are immaterial against KakaoPay's market value. The PIPC (Personal Information Protection Commission, Korea's data-privacy watchdog) imposed a ₩5.968 billion ($4.4 million) penalty in January 2025, and the FSS added a ₩12.976 billion ($9.5 million) fine plus a ₩4.8 million ($3,500) administrative penalty in February 2026 along with an "institutional warning," a heavy sanction, per Chosun Biz and Seoul Economic Daily. Combined, that roughly ₩18.9 billion ($13.8 million) is about 0.4% of KakaoPay's ₩5.16 trillion ($3.77 billion) market capitalization, based on the July 9 close of ₩37,450 reported by stockanalysis.com.
What a criminal case adds is personal liability for named executives and open-ended reputational risk for a fintech whose entire franchise rests on trust in how it handles money and identity. KakaoPay shares fell 1.83% on July 9, the trading day the raid was reported, per stockanalysis.com — a muted move that suggests the market had largely absorbed the regulatory phase but is now weighing the criminal one.
The legal trajectory is running against KakaoPay
The court signals so far have not favored the company. KakaoPay sued the PIPC to overturn its ruling, but a court dismissed the challenge on June 11, 2026, finding it "difficult to conclude" that customers knew of, or specifically consented to, their data being used as a credit-style scoring input by Apple; KakaoPay has appealed, Chosun Biz reported.
Korea has a cautionary precedent. In the 2014 credit-card breach, personal data on roughly 100 million accounts leaked from KB Kookmin Card, NH Nonghyup Card and Lotte Card; executives offered to resign, the firms were barred from issuing new cards for three months, and courts later ordered ₩100,000-per-victim compensation (Korea Herald, Korea Times). That episode shows how a Korean data scandal can move from regulator to criminal court to civil damages over several years — and how the operational and personnel fallout can outweigh the headline fines.
What to watch
The near-term signposts are procedural: whether police, after analyzing the seized records, indict the corporation and any named individuals, and how KakaoPay's appeal of the June 11 administrative ruling fares. Either could reset the market's read on how much of this is finished and how much is still ahead. The recurring, harder-to-quantify risk is the shareholder conflict at the center of the case — a Chinese strategic investor that is simultaneously the counterparty to the disputed data flow.
This article is journalism, not investment advice. LineVest is not a registered investment adviser. Figures are converted at roughly 1 USD = 1,370 KRW unless otherwise sourced.
