Key points. This table has 34 rows, one per incident (parallel suits over one incident against different defendants are separate rows), in which data subjects sued a business or public body in Korea for civil damages: 23 mass breaches and 10 insider disclosures, plus an access-refusal case counted separately. The claimants obtained an award in 21 and lost in 13; 18 rows became final at the Supreme Court. In the 12 mass breach incidents that are final with an award, the amount is KRW 70,000 to KRW 1 million per person. In insider disclosure cases the organisation was ordered to pay in 7 incidents, in amounts from KRW 100,000 to KRW 10 million. The fact of a leak has not been enough on its own. What has separated an award from a dismissal is whether the data actually circulated or could be accessed by third parties, and whether the operator breached its duty of protection.
A head office assessing a Korean incident can usually find the regulator's sanction. The civil side is harder: what a Korean court has ordered a defendant to pay each affected person, in which kinds of incident, and how often the answer was nothing. Press coverage reports the size of the leak and commentary discusses doctrine, but we have not found the per-person amounts set out side by side in English. This page does that from the judgments themselves, using the same data as the Korean table.
34incidents
21damages awarded
13claims dismissed
18final at the Supreme Court
10insider disclosure
| Incident · Defendant | Outcome | Award per person | Procedural history | What decided it |
|---|---|---|---|---|
| Mass breach Online game users' personal information exposed (2005) NCSOFT · named in the appeal judgment A system incident in the game service created a risk that users' personal information would be exposed (2005-05-11) | Claim upheldFinal at the Supreme Court | KRW 100,000 per person, finalclaim upheld for 3 of 5 plaintiffs; the first-instance award of KRW 500,000 each was reduced on appeal |
| The court weighed heavily the information-management responsibility of a business that earns revenue from a large number of users, but did not recognise mental distress for plaintiffs whose log file was only stored on the user's own PC and for whom there was no material showing an actual leak. |
| Mass breach Bank e-mail dispatch error: personal information exposed in an attachment (2006) KB Kookmin Bank · named in the appeal judgment In the course of sending an e-mail, a text file containing names, resident registration numbers and e-mail addresses was attached and sent to 3,723 members (2006-03-15) | Claim upheldFinal at appeal (no appeal to the Supreme Court) | KRW 200,000 per person (Lists 1 and 2) / KRW 100,000 (List 3), finalraised on appeal from KRW 100,000 / KRW 70,000 at first instance |
| Identifiability was greater because name, resident registration number and e-mail address were combined; the responsibility of a business that uses personal information for profit; the bank had itself undertaken responsibility in its privacy policy and terms; and the identity-theft blocking service offered after the incident was limited to 1 year. |
| Mass breach Online game accounts opened under stolen identities (2006) NCSOFT and 1 other · named in the appeal judgment Third parties signed up as game members using the plaintiffs' identities; the game company's responsibility for identity verification and management was in dispute | DismissedFinal at the Supreme Court | — |
| Tort liability of the game company denied. |
| Mass breach Job applicants' information exposed on a recruitment site (2006) LG Electronics Job applicants' information (including photographs) was exposed to the outside on the recruitment site (2006-09-26) | Claim upheldFinal at the Supreme Court | KRW 300,000 per person, finalplaintiffs in Schedule 1; the first-instance award was reduced on appeal |
| The court expressly named as assessment factors the level of security measures at the time of the incident, the speed and adequacy of the response afterwards, and the adequacy of the guidance given to those affected. |
| Mass breach Online marketplace hacked: mass leak of member information (2008) 이베이옥션 and 인포섹 · 이베이옥션 was the operator of auction.co.kr, then an eBay unit Hacking of the main database server leaked members' names, resident registration numbers, addresses, telephone numbers, IDs, bank account numbers and other data | DismissedFinal at the Supreme Court (3 parallel Supreme Court appeals) | — |
| The reference case for the rule that an operator which has taken the measures in the notice "Standards for Technical and Managerial Protective Measures for Personal Information" has not, in principle, breached its duty to take protective measures. It has been cited repeatedly in later hacking litigation and became the threshold for finding an operator negligent. |
| Mass breach Oil refiner's bonus-card customer data taken out by an employee (2008) GS Caltex, 지에스넥스테이션 and others An employee of the processor extracted the customer data of bonus-card members, carried it out on storage media and passed it on for the stated purpose of tipping off the press | DismissedFinal at the Supreme Court | — |
| The leaked data was recovered and seized in full before it circulated, so the likelihood of third-party access was low; no mental harm compensable by damages arose. The criteria that later judgments cite repeatedly (type of information, identifiability, whether it was accessed, extent of spread, likelihood of further harm, recovery efforts) were established in this judgment. |
| Mass breach Smartphone location data collected without authorisation (2010–2011) Apple Korea and Apple Inc. · named as in the Supreme Court judgment A defect by which cell-tower and Wi-Fi location values were sent to the server even when location services were set to "off" | DismissedFinal at the Supreme Court | — |
| The fact of collection alone was not accepted as mental harm compensable by damages. An officially reported judgment that settled the criteria for damages over unauthorised collection of location data. |
| Mass breach Taxi drivers' location data viewed without authorisation (call dispatch system) Persons connected with the operation of a call dispatch system Location data of owner-drivers of taxis was collected and viewed without consent | Claim upheldFinal at the Supreme Court (after remand) | KRW 200,000 per person, final |
| The Supreme Court set out criteria for damages over unauthorised collection and use of location data (identifiability, whether it was accessed, duration, recovery efforts and others) and reversed the judgment below, which had rejected the claim without examining them. After remand KRW 200,000 per person was maintained, and the second Supreme Court judgment corrected only the starting point of the default-interest rate (whether contesting the claim was reasonable under art. 3(2) of the Act on Special Cases Concerning Expedition of Legal Proceedings). |
| Mass breach Telecom operator's sales system: customer data leaked (2012) KT · named in the first-instance judgment; anonymised in some appeal judgments Persons who abused query rights in the sales system (N-STEP) looked up and leaked customer data, which was used for telemarketing and other purposes | DismissedConverged on dismissal in the appeal and Supreme Court judgments identified (many parallel strands) | —first instance awarded KRW 100,000 per person; set aside in full on appeal |
| The first-instance court recognised mental harm from the fact of leakage and circulation, but the appeal court and the Supreme Court denied the operator's liability under the test for breach of the duty to take protective measures (compliance with the notice). The representative case of a first-instance award overturned by the higher courts. |
| Refusal of access or disclosure Three telecom operators refused requests to disclose records of subscriber data provided to investigators (2013): not a leak, an access-refusal case SK Telecom, KT and LG Uplus Users whose requests for disclosure (access) of the records of subscriber data provided to investigative agencies were refused claimed damages for non-pecuniary loss | Claim upheldFinal at the Supreme Court | SKT KRW 300,000 per person; KT and LGU+ KRW 200,000 per personthe appeal-court awards became final unchanged |
| Not a leak case but a refusal of an access or disclosure request: blocking the exercise of the right to informational self-determination was itself held compensable. A rare final judgment awarding compensation for an infringement without a leak. |
| Mass breach Telecom operator's website hacked through the bill-inquiry function (2013–2014) KT A hacker used the Paros program to forge bill-inquiry requests on the website, leaking 11,708,875 items of personal information of 9,818,074 users | DismissedFinal at appeal (no further appeal); in one other strand the action was withdrawn at the Supreme Court | — |
| Although the leak was on the scale of 10 million people, none of the actions identified ended with the claimants succeeding (dismissals became final and one strand ended when the action was withdrawn at the Supreme Court stage; the strands in which the first-instance court awarded KRW 100,000 per person were also set aside on appeal). The hacker's unusual method of attack and the operator's performance of protective measures were the grounds for denying negligence. The case shows that the outcome turns on whether a duty was breached and not on the scale of the leak. |
| Mass breach Card company customer data leak: Lotte Card (2010 and 2013) Lotte Card and Korea Credit Bureau (KCB) During an FDS development project, outsourced development staff carried card customer data out on USB. Of the data taken in April 2010, the records of 2.55 million people were passed to third parties; the data taken in December 2013 was not circulated because of arrest and seizure | Claim upheldFinal at the Supreme Court | KRW 70,000 per person, finalKRW 100,000 at first instance, reduced on appeal. Claims over the December 2013 leak dismissed |
| Within the same incident, only the batch that reached third parties was upheld, and for the batch seized before circulation no mental harm was recognised. Whether the data circulated decided between upholding and dismissal. |
| Mass breach Card company customer data leak: KB Kookmin Card (2013) KB Kookmin Card and Korea Credit Bureau (KCB) Customer data leaked during an FDS development project (an incident of the same structure as Lotte Card above) | Claim upheldFinal at the Supreme Court (several parallel actions) | KRW 100,000 per person, finalKRW 100,000 each in all 3 judgments below (Suwon District Court 2016나55780 and Seoul High Court 2016나2049021 dismissed the appeals; Seoul Central District Court 2016나15432 reduced the award to KRW 100,000 on appeal. The full texts of the judgments below are not in the public case-law database and were checked in the judgment-viewing database, 2026-08-24) |
| The court found that the leaked data is closely tied to private life and credit, could be misused for secondary crime, and was accessed or highly likely to be accessed in the course of its spread. It confirmed that assessing the amount of damages for non-pecuniary loss is within the discretion of the fact-finding courts. The awards in 3 parallel actions all converged on KRW 100,000 per person. An action over the same incident filed 7 years later was dismissed because the limitation period had run (2020가단5259622). |
| Mass breach Card company customer data leak: NongHyup (2013) NongHyup Bank and Korea Credit Bureau (KCB) Card customer data leaked during an FDS development project (same structure) | Claim upheldFinal at the Supreme Court | KRW 100,000 per person, finalKRW 100,000 each, jointly with NongHyup Bank, in the judgment below (the full text of the judgment below is not in the public case-law database and was checked in the judgment-viewing database, 2026-08-24) |
| The same criteria as the KB Kookmin Card case above. Apart from Lotte Card (KRW 70,000, final), the awards in the parallel actions over the 3 card companies' leak were all KRW 100,000 per person. |
| Mass breach Nate and Cyworld hack (2011) SK Communications Mass leak of members' personal information through hacking | DismissedFinal at the Supreme Court | — |
| Breach of the operator's duty to take technical and managerial protective measures was denied. The representative case showing how hard it is to establish an operator's negligence in a hacking incident. |
| Mass breach Hypermarket prize-draw personal information provided to insurers (2011–2014) Hypermarket operator · anonymised in the judgment Personal information collected through prize draws was sold to insurance companies, and members' information was provided without consent for insurers' pre-filtering | Claim upheldFinal at the Supreme Court | KRW 200,000 per person for plaintiffs who entered the prize draws and KRW 100,000 per person for plaintiffs whose data was provided for pre-filtering, finalKRW 50,000–120,000 by category at first instance |
| Not a leak but "provision to a third party without consent"; the amount was assessed differently by type of provision (prize-draw entry vs pre-filtering). |
| Mass breach Online service hacked: e-mail addresses and encrypted passwords leaked (2021) Online service operator · anonymised in the judgment E-mail addresses and encrypted passwords were leaked in a hacking attack while the web application firewall was disabled. The Personal Information Protection Commission separately imposed a penalty surcharge and an administrative fine for this incident on 2022-09-14 (breach of the duty to take safety measures) | DismissedFinal at the Supreme Court | —claim for statutory damages of KRW 300,000 dismissed |
| The court set out for the first time that, in a claim for statutory damages under art. 39-2 as well, the personal information controller is exempt if it proves that "no mental harm warranting damages has arisen". The case shows that an administrative sanction (penalty surcharge) and civil compensation run separately. |
| Insider disclosure Disciplinary and litigation records kept by a police litigation representative filed in a civil action (2019) Police officer (litigation representative) and commissioner of a provincial police agency · anonymised in the judgment The police-side litigation representative in an action to revoke a disciplinary measure kept copies of the plaintiff's disciplinary record, appeals-commission record and administrative-litigation record, obtained in the course of duty, and filed them as documentary evidence through counsel in a civil action the plaintiff had brought against the representative personally | DismissedFinal at appeal | — |
| Keeping copies did not put the data in a state in which third parties could learn of it, so it was not a "leak" (art. 59 subpara. 3). Filing with the court is hard to regard as "disclosure" (art. 59 subpara. 2), and even if it were, it was a justified act done to prove the propriety of the litigation work, which excludes unlawfulness. The argument that the personal information controller (the police commissioner) breached the breach-notification duty was also rejected because there was no leak. A case that drew the outer limits of "leak" and "disclosure". |
| Mass breach Accommodation-booking app hacked: booking data leaked and threatening text messages sent (2017) Accommodation-booking app operator · anonymised in the judgment An outsider carried out an SQL injection attack on the marketing-centre web page, extracted member data and accommodation-booking data, and sent some users text messages referring to their bookings | Claim upheldFinal at first instance (finality record in the judgment search service, checked 2026-09-17) | KRW 100,000–400,000 per personKRW 400,000 for plaintiffs whose booking data leaked and who also received a threatening text; KRW 200,000 where only booking data leaked; KRW 100,000 for plaintiffs for whom only part of the data was their own |
| The court regarded the breach of protective measures as serious and divided the amount into three tiers by the nature of the leaked data (accommodation bookings) and by whether there was secondary harm in the form of threatening texts. An example of damages set differently by degree of harm within one incident. |
| Mass breach Cryptocurrency exchange member data leak (2017) Cryptocurrency exchange operator · anonymised in the judgment A hacker extracted members' personal information by planting malware on the operator's personal computer or by a dictionary attack. The plaintiffs alleged that their cryptocurrency was stolen in the account hacking that followed | Upheld in partFinal at first instance (finality record in the judgment search service, checked 2026-09-17) | KRW 100,000 per personupheld only for the 1 plaintiff whose name, date of birth and telephone number were confirmed to have leaked |
| Damages were awarded only to the plaintiff for whom a breach of protective measures such as encryption and a leak were confirmed, and the loss from stolen cryptocurrency was rejected because causation with the leak was not proved. The case shows that the fact of leakage has to be proved plaintiff by plaintiff. |
| Mass breach Dating app server hacked and operator blackmailed: sign-up verification documents leaked (2021) Dating app operator · anonymised in the judgment A hacker who had been a member hacked the server, extracted the personal information of members (about 143,000 people) and then blackmailed the operator. The operator had kept resident registration numbers, certificates of employment, real-estate contracts and photographs, received for sign-up verification, without destroying them after verification | Claim upheldFinal at appeal (finality record in the judgment-viewing database) | KRW 1 million per person against the operator, finalthe operator bears KRW 1 million jointly out of the KRW 10 million awarded against the hacker; at first instance KRW 5 million jointly with the hacker |
| The operator was held responsible for not destroying sensitive documents that had served their purpose, but its follow-up measures, including reporting to the police and responding to the blackmail, were taken into account, and damages were set differently for the hacker (KRW 10 million) and the operator (KRW 1 million). A case in which retention itself was a ground for compensation. |
| Mass breach Travel agency website hacked (2024) Travel agency · anonymised in the judgment A hacker uploaded a web shell to the enquiry board and extracted member and non-member data from the DB server (names in Korean and English, date of birth, sex, mobile phone number). The operator gave notice only after 2 months had passed from learning of the leak | Claim upheldFinal at appeal (finality record in the judgment-viewing database) | KRW 100,000 per person, finalKRW 2,200,000 claimed; plaintiff's appeal dismissed |
| The court found breaches of the safety-measures duty (art. 29), the destruction duty (art. 21) and the duty to notify within 72 hours (art. 34), and applied the reversal of the burden of proof in PIPA art. 39(1), but because the leaked items were at the level of contact details, damages were KRW 100,000. The delay in notification did not raise the amount much either. |
| Mass breach Contact details collected from an employee's business cards leaked when a contractor was hacked Company · anonymised in the judgment; sector not stated The company held, without consent, contact details (name, mobile phone number, workplace name, e-mail) that an employee had obtained by exchanging business cards at another workplace before joining. They were leaked together with a large amount of other data when the server of the company's IT-facilities contractor was hacked | Claim upheldFirst instance (no record of an appeal, checked 2026-09-12) | KRW 300,000 per personKRW 1,200,000 claimed |
| The court rejected the claim that the data was credit information under the Credit Information Act and, construing the claim favourably, upheld it as a tort in violation of PIPA consisting of collection without consent and a leak caused by neglect of safety measures. Business-card data is personal information once a company holds it, and an incident on a processor's server becomes the responsibility of the entrusting party. |
| Mass breach Prescription data collected through pharmacy claims software and provided to a foreign-affiliated research company (2011–2013) Pharmacists' association, a pharmaceutical-information foundation and the Korean entity of a foreign healthcare-data research company · anonymised in the judgment Patients' prescription data from pharmacies nationwide was gathered through software for pharmacy insurance-benefit claims, encrypted, and then provided to a foreign-affiliated research company; the persons involved were criminally indicted | DismissedFinal at the Supreme Court | —KRW 1 million per person claimed |
| Mental harm was denied on the grounds that the data was encrypted and used only for statistical analysis, that there was no possibility of third-party access and no secondary harm, and that the data on the overseas server had also been deleted. Statutory damages (art. 39-2) apply only to leaks on or after 2015-07-24 and could not be applied retroactively. An example showing that civil damages are a separate matter even where unlawful collection and provision led to criminal indictment. |
| Mass breach Overseas social media: data provided to third-party apps and change of operating entity not notified (2018) 2 overseas social media operators · anonymised in the judgment An allegation that the personal information of users' friends was provided to third-party apps; and the act of changing the entity providing the service to Korean users from one overseas entity to another without giving notice of the transfer | DismissedFirst instance (no record of an appeal, checked 2026-09-12) | —KRW 500,000 per person claimed |
| The plaintiffs did not prove, plaintiff by plaintiff, that their data had been provided to a third-party app. A breach of the duty to give notice of the transfer when the operating entity changed (former Network Act art. 26) was found, but the court saw no loss because the way the data was managed was the same before and after the transfer. Even where a breach of a notice duty is found, loss still has to be proved separately for each plaintiff. |
| Insider disclosure Station employee looked up a home address on the internal network and then committed murder: the Sindang Station case (2021–2022) Seoul Metro An employee who had been removed from duty looked up the victim's home address and other personal information in the internal integrated information system, sought the victim out and killed the victim. The bereaved family sued the corporation for vicarious liability and for breach of the duty to protect personal information | Upheld in partPending at the Supreme Court (2025다215622, checked 2026-09-12) | KRW 10 million in damages to the deceasedKRW 5 million to each of the parents as heirs (vicarious liability for the crime itself denied) |
| Vicarious liability was denied because the crime could hardly be regarded as connected with the performance of the corporation's business. The court nevertheless recognised mental harm from the very fact that the personal information was looked up, on the basis of a breach of access control (art. 29) in failing to block access to and queries on the internal network by an employee removed from duty. The fact that the corporation afterwards blocked home-address queries was also taken into account. |
| Insider disclosure District-office official looked up vehicle registration data and leaked it to a private investigator (2020) Suwon City An official of the city, in return for money, looked up the plaintiff's vehicle registration data, including personal details and home address, and passed it to a private-investigation operator over Telegram | Claim upheldFinal at first instance (finality record in the judgment search service, checked 2026-09-17) | KRW 2 millionKRW 10 million claimed |
| Because the official, in performing official duties, intentionally provided personal information for profit (art. 70 subpara. 2), the local government compensates under art. 2 of the State Compensation Act. An insider's crime also becomes the institution's liability to compensate. |
| Insider disclosure Notice of an administrative measure against an aviation worker, stating personal information, sent to other companies (2019) Republic of Korea (Ministry of Land, Infrastructure and Transport) In giving notice of an administrative measure against an aviation worker's licence, an official letter stating the name, date of birth, licence number and period of the measure was also sent to, among others, the heads of airlines to which the plaintiff did not belong | Upheld in partFinal at appeal (finality record in the judgment search service, checked 2026-09-17) | KRW 700,000dismissed at first instance → upheld on appeal |
| Provision to third parties beyond the purpose (art. 17(1)) was found, but the award was limited to KRW 700,000 on the grounds that there was no evidence the recipient companies spread the data further internally and that any such spread is the recipients' responsibility. |
| Insider disclosure Military Manpower Administration enlistment notice posted publicly on an apartment entrance door (2018) Republic of Korea (Military Manpower Administration) When the enlistment notice could not be served, an Administration employee posted a "Notice from the Military Manpower Administration", stating matters relating to the plaintiff's evasion of enlistment, on the apartment entrance door and elsewhere, where an unspecified number of people could see it, for about 3 hours | Upheld in partFinal at the Supreme Court (dismissed without further examination of the appeal (discontinuation of adjudication), 2020다236923) | KRW 1 million, finaldismissed at first instance → upheld on appeal; KRW 50 million claimed |
| Even allowing that the motive was a public one, that the data was not sensitive information and that the posting was short, the court held that it was not a justified act because no method of reducing the disclosure was used, such as folding the notice so that only a limited group such as family could read it. |
| Insider disclosure Psychiatric treatment history in teacher personnel-meeting minutes viewed by other teachers (2019) School foundation and the secretary who prepared the minutes · anonymised in the judgment The secretary uploaded minutes recording the plaintiff's psychiatric treatment history to the school administration system without setting access restrictions, so that other teachers were able to view them | Upheld in partFinal at the Supreme Court | KRW 1,500,000, finaldismissed at first instance → upheld on appeal; KRW 5 million claimed |
| Negligence was found in uploading sensitive information (health) to an internal system without restricting access, and the school foundation, as employer, compensates together with the secretary. A case in which viewing inside the organisation, without any external leak, was a ground for compensation. |
| Insider disclosure Employee who made an internal referral disclosed the plaintiff's job application to a person connected with the plaintiff's workplace (2023) Entertainment management company · anonymised in the judgment The plaintiff applied for a job through the employee-referral scheme, and the referring employee of the company told a person in the industry in which the plaintiff was then employed that the plaintiff had applied | Upheld in partFirst instance (no record of an appeal, checked 2026-09-12) | KRW 1 millionKRW 30 million claimed |
| Liability under PIPA art. 39(1) was found, but the award was KRW 1 million, taking into account that the disclosure reached only part of the industry, that causation with the plaintiff's resignation and inability to find new employment was not proved, and "the average amount of damages ordinarily awarded for a personal information leak". |
| Insider disclosure Apartment management-office staff posted a list of residents (2020) Apartment management contractor · anonymised in the judgment The management section chief and the head of the management office posted a list showing residents' unit numbers and names at the entrance of each building; the employees and the company were convicted of violating PIPA on summary indictment | Claim upheldFinal at first instance (finality record in the judgment search service, checked 2026-09-17) | KRW 100,000 per person37 plaintiffs; KRW 3 million each claimed |
| The management contractor bears vicarious liability under art. 756 of the Civil Act for its employees' disclosure, but the award was KRW 100,000 per person on the ground that the data disclosed was only unit numbers and names. Even with a criminal conviction, damages follow the nature of the information. |
| Insider disclosure Education-office counselling body: alleged leak of a teacher's counselling application and its transfer to the personnel division (2019) Busan Metropolitan City · named in the Supreme Court judgment A teacher who had received counselling on teachers' rights alleged that the counselling teacher's passing of the counselling application to an outside doctor, the transfer of the legal-counselling application to the personnel division and other acts were leaks of personal information | DismissedFinal at the Supreme Court | —partial award at first instance set aside on appeal |
| The court held that the counselling application is a document that has to be preserved as a public record, so its transfer to the personnel division alone is hard to regard as disclosure or use beyond the purpose. A case that distinguished a transfer of records inside an institution from disclosure outside it. |
| Insider disclosure National Health Insurance Service employee told a family member about the insured person's workplace (2017) National Health Insurance Service When the plaintiff's mother asked about the assessment of insurance contributions, an employee of the Service, while explaining the procedure for acquiring dependant status, told her information about the plaintiff's workplace; the plaintiff had been concealing the workplace from the family | DismissedFinal at appeal (finality record in the judgment search service, checked 2026-09-17) | —KRW 10 million claimed; changed to statutory damages on appeal |
| The court accepted that the employee had leaked the information, but held that statutory damages (art. 39-2) still require proof of the fact that loss occurred, though not of its actual amount. Because the information became known only to one specific person (the mother) and there was no possibility of third-party access, the claim was dismissed. An early judgment that read the requirements for statutory damages narrowly. |
How to read this table
A row is an incident, not a judgment. Where one incident produced judgments at first instance, on appeal and at the Supreme Court, they sit in one row in sequence, each with its court, case number and date. Case numbers are left in Korean because that is the form in which a judgment is retrieved. Where one incident produced parallel actions against different defendants, as with the card company leak, each defendant has its own row, because the date of finality and the amount differ by defendant.
Do not average across the two incident types. A mass breach is a system incident, or an unauthorised collection or provision, affecting many people at once. An insider disclosure is a case in which an employee or a public body looked up, disclosed or published one identified person's information. Courts assess the second type on that person's own circumstances, so the amounts spread far more widely and can reach millions of won for one person. An average over both types describes neither. Insider disclosure rows are limited to cases in which the organisation was a defendant or its liability was in issue. Actions against an individual employee alone and disputes between private individuals are left out. One row concerns a refusal to disclose records, with no leak at all, and is labelled separately and kept out of the mass breach counts.
A dash (—) in the amount column means the claim was dismissed. Every row with an award states the amount.
Final amounts and first-instance amounts are different things. Several first-instance awards in this table were reduced, increased or set aside on appeal. Where a case is final, the row shows the final amount first and records what the first-instance court awarded underneath. Recent judgments for which we found no record of an appeal are labelled as first instance in the status column. Their amounts are not final and are not included in the range given in the key points.
Defendants appear as the judgment discloses them. A defendant is named only where the judgment names it. Where the court anonymised the defendant, the row gives the sector, and we do not identify the defendant from other material. Named organisations that use an English name themselves are shown under that name. The others are left in Korean, so that the row can be matched to the original judgment without relying on a romanisation of our own making.
What decides the outcome
Circulation and third-party access often decide the outcome. In the oil refiner case, a processor's employee took bonus-card customer data out of the company, but all of it was recovered and seized before it circulated. The Supreme Court held that no mental harm compensable by damages had arisen (2011다59834 and others, 26 December 2012). The Lotte Card row shows the same reasoning inside one incident. Claims over the batch that reached third parties were upheld, while claims over the batch seized on the leaker's arrest were dismissed.
The 2011다59834 judgment is also the source of the list that later judgments repeat. The courts consider the type and nature of the information, whether the data subject can be identified, whether a third party accessed the data or was likely to, the extent of the leak and its spread, the likelihood of further infringement, how the data was managed and how the leak happened, and what was done to contain the harm. The rows in the table show these factors at work in both directions. In the card company cases the courts treated the data as closely tied to private life and credit and likely to have been accessed as it spread, and awarded KRW 70,000 to KRW 100,000 per person. In the dating app case, the row at the top of the final range, the operator had kept identity documents collected for sign-up verification after their purpose was spent.
In the hacking cases in this table, the outcome turned on breach of duty and not the size of the leak. Several of the largest incidents in the table ended with nothing awarded. The online marketplace case established that an operator which had taken the measures set out in the regulator's notice on technical and managerial protective measures had not, in principle, breached its duty of protection, and later hacking judgments have applied that test. In a telecom website hack on the scale of ten million users, none of the actions we identified ended with the claimants succeeding: the dismissals rested on the unusual method of attack and the operator's performance of protective measures, and one strand ended when the action was withdrawn at the Supreme Court stage.
Statutory damages do not remove the need for harm. PIPA art. 39-2 allows a data subject to claim statutory damages, which eases the burden of proving loss. In 2023다311184 the data leaked was limited to e-mail addresses and encrypted passwords. The Supreme Court dismissed the appeal in a case that included a statutory damages claim and held, for the first time, that the controller is exempt under art. 39-2 as well if it proves that no mental harm warranting damages arose. An earlier lower-court judgment in the table took a similar line where an employee's disclosure reached only the claimant's mother. Art. 39-2 was also held not to apply retroactively in the prescription-data case, where the court noted that it covers leaks on or after 24 July 2015.
Proof is plaintiff by plaintiff, and timing can matter. In the cryptocurrency exchange case only the plaintiff whose leak was confirmed received an award, and the claim for stolen cryptocurrency failed on causation. In the KB Kookmin Card row, an action brought seven years after the incident was dismissed because the limitation period had run.
A penalty surcharge is not civil liability
A regulator's sanction and a civil award answer different questions, and one does not settle the other. The clearest example in the table is 2023다311184. The Personal Information Protection Commission had imposed a penalty surcharge and an administrative fine on the operator for breach of the safety-measures duty, and the civil claim was nevertheless dismissed at all three levels, because what leaked did not amount to compensable mental harm.
The same separation appears with criminal proceedings. In the prescription-data case the persons involved were indicted, and the civil claim was still dismissed for want of mental harm. In the apartment residents' list case there was a criminal conviction, and the award was set by the limited nature of the information disclosed.
For the sanction side, the PIPC enforcement tracker lists the Commission's published decisions, the fine calculator sets out how a surcharge or fine is computed, and the breach notification page covers the notification duty.
What is not in this table
- Judgments that are not in public case-law databases. Several widely reported incidents are absent because no judgment text was available to us. Absence from this table does not mean that no action was brought or that nothing was awarded. Lower-court judgments are added as their texts are obtained.
- Administrative cases. Actions to set aside a Commission sanction are a different kind of proceeding. They are summarised on the enforcement tracker and listed on a Korean page.
- Criminal cases and settlements. The table records amounts awarded in civil judgments only. It does not cover investigations, prosecutions or out-of-court settlements.
Frequently asked questions
Q. How much do Korean courts award per person for a data breach?
In the mass breach cases in this table that have become final with an award (12 incidents), the amount is between KRW 70,000 and KRW 1 million per person. The top of that range is a dating app operator that kept resident registration numbers and certificates of employment collected for sign-up verification instead of destroying them. Examples lower in the range are the card company customer data cases at KRW 70,000 to KRW 100,000, the sale of prize-draw entrants' data at KRW 100,000 to KRW 200,000, and a recruitment-site exposure at KRW 300,000. A leak alone has not been enough: where the data was recovered or seized in full before it reached third parties, the courts found no compensable mental harm and dismissed the claims.
Q. If the regulator has imposed a penalty surcharge, does civil liability follow?
The two are decided separately. In one case in this table the Personal Information Protection Commission imposed a penalty surcharge and an administrative fine for breach of the safety-measures duty after a website was hacked, and the civil claim was still dismissed, because the only data leaked was e-mail addresses and encrypted passwords and the courts found no mental harm warranting damages. The Supreme Court upheld that result (2023다311184) and held that, in a claim for statutory damages under PIPA art. 39-2 as well, the personal information controller is exempt if it proves that no such harm arose.
Q. Is an organisation liable when its own employee looks up or discloses someone's data?
Often, on the cases collected here. Of the 10 insider disclosure incidents in the table, the organisation was ordered to pay in 7, in amounts from KRW 100,000 to KRW 10 million. In the Sindang Station case, the appeal court denied vicarious liability for the crime itself but awarded damages because the corporation had not blocked access to its internal system by an employee who had been removed from duty; an appeal to the Supreme Court was pending as of the date shown above the table. Claims were dismissed where the information reached only one specific person with no prospect of third-party access, and where the act was a legitimate transfer of records within the institution.
Q. What do Korean courts look at when deciding whether to award damages?
The Supreme Court's recurring list is: the type and nature of the personal information leaked; whether the data subject can be identified from it; whether a third party accessed it or was likely to; how far it leaked and spread; the likelihood of further infringement; how the party processing the data managed it and how the leak came about; and what was done to stop the harm from spreading (Supreme Court, 26 December 2012, 2011다59834 and others). Within a single incident, claims over a batch that reached third parties have been upheld while claims over a batch seized before circulation were dismissed.
Q. Why are some defendants shown in Korean or only by sector?
The table follows what the judgment itself discloses. A defendant is named only where the judgment names it; where the court anonymised the defendant, the row gives the sector and nothing more, and the defendant is not identified from other sources. Where a named organisation uses an English name itself, that name is shown. Where it does not, the Korean name stands as written, because this table does not invent romanisations and the row has to be checkable against the original judgment.
Sources and corrections
Every row was written from the full text of the judgments. Judgments published on the National Law Information Center (law.go.kr) are the base, and judgments at other levels that are not published there were checked in a judgment search service. Counts, amounts and statuses are stated as of the date shown above the table.
The whole table can be downloaded as a CSV file: damages-judgments.csv. The column names and cell contents are in Korean, as it is the file behind the Korean page. The dataset is archived on Zenodo under CC BY 4.0. The DOI 10.5281/zenodo.22722236 always resolves to the latest version, and 10.5281/zenodo.22722237 to a fixed version for citation in work that will be checked later.
If you find an error, or know of an appeal that changed a result shown here, please write to hyunsub.lee@seumlaw.com. Corrections are made after checking against the judgment. Whether a claim would succeed in a particular matter, and in what amount, depends on how the incident happened, what information was involved and whether it circulated, so nothing on this page is a view on a specific case. Questions can be sent through the contact page.