If Your Data Leaked in a Bank Hack, Compensation Splits Into Three Routes -- The Bank's Voluntary Plan, Article 9 of the Electronic Financial Transactions Act and Statutory Damages Under the Personal Information Protection Act Have Different Conditions
As reports of external hacking and customer data leaks at Shinhan, Hana and KB Kookmin banks continued, the National Assembly's Political Affairs Committee audit on October 19 made one question central: "Who has to prove what before compensation is paid?" The Shinhan Bank president said the bank plans to compensate affected customers in full regardless of the customer's own fault, but the details differ by bank and many parts are still not final. That is why it helps to separate the voluntary compensation banks have announced from the liability the law already sets. This article is based on the Ministry of Government Legislation's Easy Law portal and news reports of October 19-20.
So far the banks have offered perks and insurance
According to reports, Shinhan Bank is enrolling all of the roughly 25,000 customers whose data leaked in a financial-crime damage insurance plan with a limit of KRW 10 million per person for one year, with the premium paid by the bank. Fee waivers and preferential exchange rates are added. Hana Bank is upgrading the 89 customers affected to VIP status, waiving remittance, ATM and OTP issuance fees, and helping them enroll in a financial identity protection service. KB Kookmin said it is reviewing a compensation plan. It was also reported that the Shinhan and Hana packages include no cash compensation.
Even if a bank says "full compensation," read the proof wording first
At the audit, lawmakers asked whether customers must prove secondary damage themselves, and the word "proven" in KB Kookmin's compensation policy was criticized. In other words, even the same "full compensation" may differ by bank on whether a leak alone qualifies or actual damage must be confirmed. Get in writing, from the notice or the help desk, which items are paid on a leak alone and what documents you must submit if damage occurs.
Route one: Article 9 of the Electronic Financial Transactions Act, liability for money that left the account
The liability set by law is separate from a bank's voluntary plan. Article 9(1) of the Electronic Financial Transactions Act makes a financial company liable for losses to users caused by forgery or alteration of an access medium, an accident in the electronic processing of a transaction instruction, or use of an access medium obtained illegally by breaking into the network. Access media are means such as passwords, biometrics, security cards and OTPs. A leak of a name or contact details alone does not trigger this article directly; it becomes an issue when money is taken out using the leaked information. Where the line between data and an access medium falls depends on the case.
A bank can shift liability only on grounds written in its terms
Article 9(2) lets a bank place all or part of the liability on the user only where the user acted intentionally or with gross negligence and agreed in advance to bear it. Even then, gross negligence is limited to cases the Enforcement Decree lists and the terms state. They include lending, transferring or pledging an access medium to someone else; disclosing, exposing or leaving it unattended when you knew or could easily have known that a third party could misuse it; and refusing, without good reason, an extra security measure the bank required. If you never shared your passwords or OTP with anyone, you are unlikely to be disadvantaged on this standard.
Route two: the Personal Information Protection Act, KRW 3 million statutory damages and the burden of proof
Article 39 of the Personal Information Protection Act says a handler cannot escape liability unless it proves it had no intent or negligence. Article 39-2 lets a data subject claim a reasonable amount of up to KRW 3 million without proving the actual loss when data leaks through intent or negligence. If there was intent or gross negligence, there is also a rule allowing a court to set damages up to five times the loss. However, in January this year the Supreme Court held in the Happy Campus case that where only an encrypted password and an email address leaked and the company proved there was no damage, there is no statutory damages liability. What was leaked, and to what extent, decides the outcome.
Route three: money you sent yourself follows a different procedure
If you were deceived by a fraudster using leaked data and sent the money yourself, that is generally treated differently from an Article 9 accident. The first step there is a payment freeze and a relief application. There are reports that financial authorities are pushing to introduce no-fault liability that would compensate a certain range of damage even without the financial company's fault, but it is not an established system, so do not rely on it now. The procedure is covered in payment freezes for voice phishing through easy transfer, and the deadline in the three-business-day voice phishing relief application.
What to do now is block and keep records
Apart from the compensation debate, if you received a breach notice, first save a screenshot of it. To see how a compensation application actually proceeds, see the TVING data breach compensation application. Then change your passwords and check that no loan or account has been opened in your name through loan-transaction blocking and the all-accounts lookup. If you see an unusual transaction, write down the time, the amount and the time you reported it to the bank. Under Article 10, the financial company is liable for losses from the time it is notified of a loss or theft, so notify immediately if in doubt.
If the bank refuses, demand a dispute review; the order of steps
If you file a damages claim in writing or electronically with the bank, the bank must tell you the result of its investigation or handling within 15 days. If you do not accept the result, you can apply for mediation with the Financial Dispute Mediation Committee of the Financial Supervisory Service or with the Korea Consumer Agency, and the FSS consultation line is 1332 with no area code.
The order is this. First, keep the notice and get the bank's compensation terms in writing. Second, change passwords and block identity theft. Third, if money leaves your account, report to the bank at once and press the Article 9 liability. Fourth, if there is no answer or a refusal within 15 days, apply for mediation. Bank compensation terms keep changing, and this article reflects reports as of October 20. It is general information and does not replace legal advice, so confirm your specific case with the bank and the Financial Supervisory Service.
All content is fact-checked under our editorial standards.