“Is 100,000 won all they get?” ... Bank hack fuels push for sweeping class-action law

[Financial News] A series of incidents causing widespread harm, including recent customer data breaches at major commercial banks, has led more victims to seek damages from companies. The National Assembly is also pushing legislation for a comprehensive class-action law, raising the possibility that victims may be compensated in the future regardless of whether they join a lawsuit. There is hope that this could overcome the limitation that victims have seen little practical benefit, given the scale of the harm and the time it takes to secure compensation. At the same time, concerns have been raised that it could lead companies to scale back investment and business activities.
According to legal circles on the 12th, some law firms are recruiting plaintiffs seeking compensation for losses caused by hacking attacks on major commercial banks. Claims of 100,000 to 300,000 won per person are under consideration.
On the 1st, a hacking attack on Shinhan Bank exposed the personal information of about 25,000 people. The information related to loan applications and included names, phone numbers, connection information (CI), annual income and loan limits. It also included 66 resident registration numbers and 97 CI records belonging to some customers.
In addition to Shinhan Bank, personal information was exposed in hacking incidents involving KB Kookmin Bank, Hana Bank, BNK Busan Bank, Yegaram Savings Bank, Welcome Savings Bank and Hyundai Capital. The financial sector plans to verify the actual harm and its causal link to the incidents before providing compensation.
However, expectations are that relatively few people will join lawsuits compared with the total number of victims. That is because it takes considerable time for compensation to be determined in court, and the amounts are not large.
When around 100 million records of personal information were exposed in 2014 at three card companies—KB Kookmin Card, NH NongHyup Card and Lotte Card—the judiciary’s final decision was to award 100,000 won per person. The cumulative number of victims reached 100 million, and even after excluding duplicates, the figure was 20 million. Yet after five years of litigation, only several hundred thousand people whose names appeared on the complaints had the 100,000-won award confirmed by the Supreme Court in 2019.
The disparity was even starker in Volkswagen’s 2015 “Dieselgate” emissions-manipulation scandal. U.S. courts secured settlements that included punitive damages and buybacks, with compensation of up to around $10,000 (about 13 million won) per car owner. By contrast, South Korean courts recognized damages of only around 1 million won per domestic car owner.
Victims pursued individual lawsuits for more than a decade over the humidifier disinfectant scandal, which claimed hundreds of lives. They struggled to prove on their own in court that toxicity data had been concealed and to establish causation.
The current Civil Procedure Act adheres to the “opt-in” principle, under which victims are covered only if they hire a lawyer or join a lawsuit themselves. This is one reason most people avoid the cumbersome legal process just to receive a few tens of thousands of won. Although the Securities-Related Class Action Act was introduced in 2005, it is limited to certain areas of the capital market, such as accounting fraud and stock-price manipulation, and does not apply to large-scale consumer harm cases.
The National Assembly is pushing a comprehensive class-action law that would extend the scope—currently limited to the securities sector—to all areas involving damages, including personal information breaches, product liability and consumer transactions. The proposal combines “opt-out,” which would include all victims in compensation, with the “Discovery” system for obtaining companies’ internal data as evidence.
If the bill passes, corporate litigation risk management will undergo a fundamental paradigm shift. Disputes that previously ended with claims limited to the number of people who joined a lawsuit could grow into a single liability exposure on the scale of hundreds of billions to trillions of won, covering all victims. A lawyer specializing in litigation said, “In the past, companies could manage matters through settlements after a lawsuit was filed. But if a comprehensive class-action system is introduced, proactive investment in security infrastructure and the establishment of quality-verification systems will become essential to corporate survival.”
There is also strong opposition from industry and business groups. They warn that if safeguards against excessive litigation are inadequate, strategically organized lawsuits could proliferate, and small and midsize companies and startups lacking financial resources and legal capacity could go bankrupt after a single dispute. Concerns have also been raised about whether the law would apply retroactively to incidents that occurred before it takes effect, and whether companies’ legitimate trade secrets could be indiscriminately disclosed during litigation.
Professor Kwon Jae-yeol of Kyung Hee University Law School explained, “In our country, unlike in the United States, where punitive damages are common, administrative surcharges and fines as well as civil lawsuits are applied, which could leave companies facing excessive liability.” He added, “If the costs of preparing for these risks surge, the share allocated to investment and growth could shrink.”
He added, “In the information and manufacturing sectors, technological advances such as AI are happening rapidly, and it takes time for responses to catch up. The characteristics of each industry should also be taken into account when determining corporate liability.”

[email protected] Lee Chang-hoon Reporter