Case korea-pipc-deepseek-prompt-transferModel & data leakSouth Korea
Korea's PIPC: DeepSeek sent Korean users' prompts to ByteDance-linked Volcano Engine
Korea's PIPC found DeepSeek sent user data and AI prompts to five firms in China and the US, including ByteDance affiliate Volcano Engine, without consent, and ordered corrective measures.
HighAttack on AIStatus: ResolvedVerified case file
Open in the interactive mapCite this case
- Reported
- Apr 24, 2025
- Location
- South Korea
- Target
- South Korean DeepSeek app users
- Severity
- High
- Triggered by
- DeepSeek (Hangzhou DeepSeek AI)
- Actor type
- Accidental / misconfiguration
- Reported loss
- None reported
- CVE
- None
What happened
Korea's PIPC found DeepSeek sent user data and AI prompts to five firms in China and the US, including ByteDance affiliate Volcano Engine, without consent, and ordered corrective measures.
Impact: Prompts and metadata of Korean users, over one million downloads, sent abroad without consent; app removed from Korean stores pending fixes.
Who triggered it
Actor: DeepSeek (Hangzhou DeepSeek AI)
Attribution: PIPC pre-inspection established the transfers; DeepSeek said Volcano Engine was used for security and UX analytics, not marketing.
Motive: Service analytics and model training; no malicious intent established.
How it happened
Attack vector: App automatically sent device, network and prompt data to overseas cloud providers on each session, with no Korean privacy policy, opt-out or age check.
Root cause: Launch without a Korean-language privacy notice, consent flow or cross-border transfer safeguards required under PIPA.
Timeline
- PIPC confirms data flow to ByteDance-linked servers; DeepSeek suspends new Korean downloads
- DeepSeek blocks new cross-border transfers of prompt data
- PIPC publishes findings and issues corrective recommendations
Response
DeepSeek added an opt-out for training use, a Korean privacy policy and age verification, destroyed transferred prompt data and was required to report compliance within 60 days.
Current status: Resolved
Sources (open in a new tab)
- Newsis newsis.com
- Hankyoreh via Daum v.daum.net
- Malwarebytes Labs malwarebytes.com
Cite this case
Korea's PIPC: DeepSeek sent Korean users' prompts to ByteDance-linked Volcano Engine. AI Threat Watch, case korea-pipc-deepseek-prompt-transfer, Apr 24, 2025. https://aithreat.io/cases/korea-pipc-deepseek-prompt-transfer/
Permanent link: https://aithreat.io/cases/korea-pipc-deepseek-prompt-transfer/