2026-07-22 KOSPI 7,166 Spike Fades, 10m Won Fine for Seoul Mayor and 10,000-Record Diplomat Data Breach
· Issue
A KOSPI that touched 7,166 and gave it all back, a 10 million won fine that puts Seoul's mayoralty on the line, and a foreign-ministry server breached for 10 months — today's three issues, read with JPMorgan's deleveraging data, the legal threshold behind the verdict and national cyberattack statistics you won't find in the original articles.
KOSPI hit 7,166 then closed at 6,797 — what the last 25% of the unwind means
The KOSPI opened 4.51% higher and triggered a buy-side sidecar, yet closed up just 0.74%. Here is why 2.61 trillion won of foreign buying could not hold the rally, in numbers.
Today the KOSPI fit both a surge and a full retreat into a single session.
On July 22 the index opened at 7,052.09, up 4.51%, triggered a buy-side sidecar at 9:06 a.m. (a 5-minute halt on program buy orders) and climbed to 7,166.00 intraday. It then gave nearly everything back in the afternoon, closing at 6,797.70 — up just 0.74%. Foreign investors bought a net 2.61 trillion won, but individuals (−1.21 trillion) and institutions (−1.39 trillion) sold into the strength (Korea Exchange).
By the end of this card you will know why the 5% surge did not hold, and how far the forced-selling cycle has actually progressed.
A buy-side sidecar — even rallies get a speed limit
Sidecars are usually associated with crashes, but when KOSPI 200 futures jump more than 5%, program buying is also halted for five minutes. The fact that today's trigger came on the buy side is itself a signal: this market's volatility is now extreme in both directions.
Why 2.61 trillion won of foreign buying was absorbed
According to the Seoul Economic Daily, 59.6 billion won of stock was force-sold from margin accounts the previous day — a second consecutive day above 50 billion won. Leveraged positions built up during the crash are still being unwound, and that overhang caps every rebound.
JPMorgan's '75% done' — which means 25% remains
As reported by Bloomberg and others, JPMorgan estimates Korean leveraged ETF assets fell from about 50 billion dollars at end-June to about 26 billion, putting the unwind roughly 75% complete. Read the other way, 25% is still to go — today's strong-open, weak-close pattern is exactly what digesting that residue looks like. JPMorgan nevertheless kept its overweight stance and a 12-month KOSPI target of 12,500.
Watch the forced-selling tape before the index itself — the real bottom signal is the day margin liquidations dry up.
Why a 10 million won fine can end a mayoralty — the threshold is 1 million
Seoul Mayor Oh Se-hoon was fined 10 million won over 21 million won of polling costs paid by a supporter. The number that matters is 1 million — the legal line that voids an election.
Heavier than the fine itself was the clause attached to it: if upheld, the mayoralty is lost.
On July 22 the Seoul Central District Court fined Mayor Oh Se-hoon 10 million won for violating the Political Funds Act and ordered 21 million won forfeited. The court found he commissioned five opinion polls from broker Myung Tae-kyun ahead of the April 2021 by-election and had longtime supporter Kim Han-jung pay the 21 million won bill. Former vice mayor Kang Cheol-won was fined 3 million won and Kim 5 million won (FN News).
This card explains why 1 million won is the line that decides an elected official's fate — and what happens next.
What the court weighed most: the concealment
The bench said the payment was deliberately concealed, tied to publishing candidate-commissioned polls banned under election law, and that a multi-term mayor "knew the purpose of the Political Funds Act and still led the crime" (MBC). It was the hiding, more than the 21 million won, that drove the sentence up.
Why the threshold is 1 million won — cutting the link between money and votes
Under Korean election law, an elected official loses the seat once a Political Funds Act fine of 1 million won or more becomes final. Today's fine is ten times that line — a deliberately disqualifying sentence. Nothing is final yet, though: an appeal and the Supreme Court remain, Oh called the ruling impossible to accept and vowed to appeal, and he keeps the office until the case concludes.
The reason this scene keeps repeating is simple: once the source of money is hidden, it is trust, not the amount, that goes on trial.
A 10-month breach at Korea's diplomatic academy — 3 steps if you get a leak notice
A server at the National Diplomatic Academy was breached for 10 months, exposing up to 10,000 records on current and former diplomats. What the 5-month disclosure delay cost, and what to do the day a notice arrives.
The scariest number in this hack is not 10,000 records — it is 10 months.
Korea's foreign ministry says an unidentified attacker took over the academy's online education server around April–May 2025, exploiting a zero-day flaw and lax security settings, and kept access until February 2026. Up to 10,000 records on serving and retired diplomats and staff seconded to overseas missions are presumed exposed. The ministry detected and blocked the intrusion in early February — but only went public and notified victims on July 20 (Asia Economic Daily).
Here is why disclosure took five months, and the exact order of what to do if you are ever on the receiving end of a breach notice.
'Attribution unknown' and five months of silence
Officials say the technical analysis is insufficient to name a culprit and that state-backed groups cannot be ruled out (Seoul Shinmun). The ministry argues it prioritized urgent security fixes, but for five months the people affected did not know their data was out. Disclosure speed is second-damage-prevention speed: impersonation and phishing start when data leaks, not when it is announced.
Attacks are the constant, not the exception — 1.62 million a day
By the National Intelligence Service's count, Korea's public sector faced an average of 1.62 million attack attempts per day in 2023, up 36% from 1.19 million in 2022 (Boan News). What makes this case special is not that an attack happened, but that a zero-day plus misconfiguration let it go unnoticed for 10 months.
Got a leak notice? Three steps, in order
You do not need to be a diplomat for the playbook to apply. Whenever an organization tells you your data leaked, move in this order.
Stopping the hack is the agency's job — but the golden hour for limiting damage afterward is the day you read the notice.
Each issue is nuloq's own analysis, drawing on the original reporting and public data (official statistics and institutional sources), written with the help of AI. See each card's link and in-text citations for sources.
Related posts
2026-07-21 KOSPI Rebounds 3.56% to 6,748 — Special Counsel Extended 30 Days, 200mm of Rain: Korea's Day in Numbers
· Issue
KOSPI bounced back 3.56% to 6,747.95 one day after its 4.46% crash. The three forces behind the rebound, a 30-day special counsel extension that ended a 50-day parliamentary standoff, and 120mm more rain on saturated ground — with context the headlines skip.
KOSPI Plunges 5.72% in a Day, Triggers Sell-Side Circuit Breaker
· Issue
South Korea's KOSPI sank 5.72% in a day and triggered a sell-side circuit breaker. What a record 45 triggers this year reveal about the chip rally's future.
South Korea's Special Counsel Hits 690 Days — Was the Extension Worth It?
· Issue
South Korea's special counsel probe just hit a record 690 days and 2.7 billion won in added funding — already longer than the U.S. Mueller investigation. Here's why, and what's left to prove.
2026-07-18 Choe Son-hui in Moscow, 61% Back Prosecutors, Galaxy Unpacked — Today's 3 Issues in Numbers
· Issue
North Korea's foreign minister made her first official visit to Russia in 9 months, and a Gallup Korea poll found 61% want prosecutors to keep supplementary investigation powers. Plus Samsung's first AI glasses due July 22 — three issues unpacked with data the original reports left out.