Bank data breach victims step up calls for compensation

A growing number of customers affected by a string of recent personal data breaches at major commercial banks and other financial firms appear to be turning to class action lawsuits in pursuit of compensation, according to industry officials, Wednesday.

The banks have pledged to fully compensate customers whose losses, including those from voice phishing scams, are found to have directly resulted from the leaks. But proving that a loss was caused by a specific data breach can be difficult in practice, and the banks have yet to set out clear standards for determining which claims would qualify, prompting some victims to resort to legal action.

Seven financial firms have reported information leaks so far, including three of the country’s largest commercial lenders — Shinhan Bank, KB Kookmin Bank and Hana Bank. Shinhan reported the largest breach, affecting around 25,000 people, followed by 119 at KB Kookmin and 89 at Hana Bank.

The exposed data includes customers’ names, contact details, resident registration numbers, annual income and loan limits.

The combination of personal and financial information could leave victims particularly vulnerable to fraud, said Hwang Sung-ho, Korea country manager at cybersecurity software company Nord Security.

“When criminals can connect someone’s personal information to their income or potential loan limit, they gain enough context to create a highly convincing and personalized scam,” he said.

Generative artificial intelligence (AI) has made it easier for hackers to tailor such schemes to individual victims, he added. “Criminals can quickly produce sophisticated phishing emails and text messages, as well as plausible scripts for fraudulent calls.”

For victims, however, establishing that a case of voice phishing or identity theft stemmed specifically from one of the breaches could prove difficult.

As a result, some have been driven toward legal action.

An online Naver community for victims seeking a class action lawsuit against Shinhan Bank has been set up. In a notice, its operator said, “The bank has promised full compensation for confirmed losses but has yet to explain what would qualify as a loss or how customers could file claims.”

Seoul-based boutique law firm Sedam Law is also recruiting eligible plaintiffs for a damages lawsuit over the Shinhan Bank data breach. The firm said it plans to sue the bank under the Personal Information Protection Act once recruitment is complete, with the amount sought per plaintiff expected to range from 100,000 won ($75) to 300,000 won.

A banking industry official said that in regard to the recent data breach, it may be difficult for individual lenders to decide on compensation at their own discretion. “The authorities and the industry would need to work together to establish standards and measures for compensation.”