Shinhan Bank Data Breach Leads to Legal Battle as Victims File Lawsuit

Shinhan Bank's data breach is heading to court as affected customers plan to file a joint damages lawsuit this month. Following the initial filing, additional participants are expected to join, potentially increasing the scale of the lawsuit.

According to legal sources on October 20, the law firm Sedam will submit a damages claim on behalf of Shinhan Bank's data breach victims later this month. Sedam, which began recruiting plaintiffs earlier this month, plans to proceed with 77 customers who have completed the participation process. The number of participants has surged from single digits to nearly 80 in just two weeks.

The amount claimed per individual is reportedly being considered at levels between $100 and $300, based on past precedents. Sedam intends to file separate lawsuits as more applicants gather after the initial submission. This means that customers who do not participate this time can still join through additional recruitment efforts.

Once the lawsuit is filed, the court will deliver the complaint to Shinhan Bank, and the legal proceedings will follow, including the submission of the bank's response. Considering that similar data breach lawsuits have taken about two months from filing to the first hearing, this case is likely to follow a similar timeline.

The central issues will be whether Shinhan Bank fulfilled its data protection obligations and the extent of its liability for damages resulting from the breach. The level of the bank's investment in information security may also come under scrutiny. According to data received by Representative Park Dae-chul of the ruling People Power Party from the Financial Supervisory Service, Shinhan Bank's information security budget for this year is approximately 40.59 billion won, the lowest among the five major banks (KB Kookmin, Shinhan, Hana, Woori, and NH Nonghyup). In contrast, the scale of the data breach affected around 25,000 individuals, the largest among commercial banks.

There is also interest in whether compensation will be provided to customers who did not suffer direct financial losses, such as from voice phishing or unauthorized withdrawals. Sedam's representative attorney, Shin Al-chan, explained, "Under the special provisions of the Personal Information Protection Act, damages can be claimed without proving specific losses, up to 3 million won." This indicates that claims can be made even without direct financial harm.

The lawsuit against Shinhan Bank may set a precedent for similar actions against other financial institutions. A legal source noted, "If other banks experience data breaches, law firms may begin recruiting participants for lawsuits, assessing the likelihood of success based on security efforts and the scope of the leaked information."

A Shinhan Bank representative stated, "We take this matter very seriously and are doing our utmost to address customer concerns and inconveniences," adding that the bank will respond diligently to the upcoming procedures. However, they refrained from commenting on specific details related to the lawsuit.