In this photo taken on July 6, 2025, an announcement regarding the waiver of penalty fees for SK Telecom customers switching carriers due to the hacking incident in April is posted at a KT store in Seoul. Yonhap News. 

Amid the Personal Information Protection Commission's Personal Information Dispute Mediation Committee recommending 300,000 won in compensation per victim related to the SK Telecom [017670] hacking incident, some in the legal community are pointing out that the compensation level is too low compared to the scale of the data leak.

On the 4th, the Dispute Mediation Committee decided on a mediation plan requiring SKT to pay 300,000 won in damages to each applicant.

Previously, around 4,000 victims had applied for dispute mediation against SKT since April.

The Dispute Mediation Committee explained that the compensation was determined based on SKT's violation of the protective measures obligation under the Personal Information Protection Act, as well as recognition of mental distress due to concerns of mobile phone duplication from the misuse of leaked information and the confusion and inconvenience during the SIM card replacement process.

While the Dispute Mediation Committee's recommendation is not a court ruling, it can be considered a legal judgment as it has the same effect as a court's settlement recommendation.

Consequently, considering that this was a large-scale incident involving over 20 million victims and 25 types of sensitive information, the compensation of 300,000 won per person is evaluated as falling short of victims' expectations.

Compensation for personal information leakage damages in South Korea generally remains at a low level.

In civil damage claims, damages are typically divided into affirmative, negative, and mental damages. In personal information leakage cases, compensation for mental distress is often the main issue, as it is difficult to prove damages when no actual financial loss has occurred.

In the 2014 incident where over 100 million personal information records, including names, resident registration numbers, and card numbers of 20 types, were leaked from KB Kookmin, NH Nonghyup, and Lotte Cards, approximately 5,000 victims filed a class-action lawsuit, but the court only awarded 100,000 won in compensation per person.

Victims had demanded a total of 1.3 trillion won, ranging from 200,000 to 700,000 won per person. However, no financial damages were confirmed, and the court took into account the credit card companies' efforts to prevent secondary damages.

In the same year, in an incident where 11.7 million personal information records of 9.81 million KT [030200] subscribers were leaked, customers filed lawsuits demanding 500,000 won per person, but the Supreme Court did not recognize KT's liability for damages. If specific financial damages are not proven, the consolation money recognized by the court is either nonexistent or mostly in the hundreds of thousands of won.

The gap widens further when compared to overseas cases.

T-Mobile, one of the three major mobile carriers in the United States, caused a stir in 2021 when a large-scale leak of personal information affected over 76.6 million current and former customers, as well as potential customers.

Consumers filed lawsuits, and T-Mobile spent $350 million (approximately 459 billion won at the time) in settlements, with victims receiving up to $25,000 (approximately 32 million won) per person depending on the scale of the damage.

Although not a legally binding court ruling, this case is considered a symbolic example of how the value of personal information is perceived.

A presiding judge at a district court in the financial sector commented, "Domestic compensation tends to underestimate mental distress and anxiety, as it is mostly focused on proving actual damages," adding, "New standards are needed that consider the sensitivity of the information and the necessity of preventing recurrence."

Meanwhile, SKT stated, "We are disappointed that our efforts in accident response and our voluntary and proactive compensation efforts have not been sufficiently reflected," and announced that it would review whether to accept the mediation plan.

The industry is also discussing the possibility that SKT may not accept the mediation plan, given the significant costs already incurred. In that case, consumers would have to seek recourse through lawsuits.

Approximately 9,000 hacking victims have filed a lawsuit against SKT seeking 500,000 won in consolation money per person, with the first hearing scheduled for January next year.

Yonhap News