Investigation Launched into Dior and Tiffany Data Breaches

The Personal Information Protection Commission (PIPC) announced on June 1 that it is investigating data breaches involving luxury brands Dior and Tiffany, both of which are flagship names under the world's largest luxury group, LVMH (Louis Vuitton Moët Hennessy). The PIPC aims to determine the specifics of the data that was compromised and the extent of the breach, as well as whether there were any violations of the Personal Information Protection Act. They are also assessing whether the responses from Dior and Tiffany following the incidents were adequate.

According to the enforcement decree of the Personal Information Protection Act, companies must report any data breaches to the PIPC within 72 hours of becoming aware of the incident. The PIPC suspects that Dior's breach occurred in January, but the company only reported the incident on May 10, stating that it became aware of the breach on May 7. Subsequently, on May 13, Dior informed its customers about the breach, revealing on its website that unauthorized third parties had accessed some customer data, including names, phone numbers, email addresses, and purchase information.

Tiffany also reported a data breach that occurred in April on May 9, with a formal report submitted on May 22. The PIPC has identified that both brands' customer data was compromised through employee accounts that had access to their online customer management systems. A PIPC official noted that there may have been insufficient control measures in place, such as the lack of two-factor authentication for employee accounts and restrictions on the IP addresses that could access the customer management site.