[Exclusive] 'Nonghyup Card Data Leak' Concludes After 10 Years... KCB to Pay 28.3 Billion Won to Nonghyup Bank

The lawsuit for indemnity and damages filed by NH Nonghyup Bank against KCB (Korea Credit Bureau) has been concluded with a partial victory for the plaintiff, bringing closure to the customer information leak incident involving a KCB employee and Nonghyup Card that occurred in 2014, nearly ten years ago. As a result of the two lawsuits, KCB is required to pay approximately 28.3 billion won to Nonghyup Bank.

원본보기 아이콘

According to the legal and financial sectors on November 21, Nonghyup Bank (Nonghyup Card headquarters) and KCB both submitted withdrawal notices for their respective appeals to the Civil Agreement Division 31 of the Seoul Central District Court on October 17, regarding the indemnity claim lawsuit filed by Nonghyup Bank against KCB. With this, the first-instance ruling in September, which was a partial victory for Nonghyup Bank, has been finalized. Previously, in June, both parties also submitted withdrawal notices for their appeals in the damages claim lawsuit, finalizing the appellate court's decision.

The KCB information leak incident dates back over a decade. Park, who was in charge of the Fraud Detection System (FDS) at KCB, was dispatched to KB Kookmin Card, Nonghyup Card, and Lotte Card from 2012 to 2013 to work on FDS project development. During this period, he illegally collected customer information by copying it onto a USB drive and leaked a total of 104 million pieces of personal data to an external company. The company intended to use this data for loan brokerage and related business activities.

원본보기 아이콘

In the indemnity lawsuit, the Seoul Central District Court ruled partially in favor of the plaintiff (Nonghyup Bank). The court determined that KCB should bear responsibility for approximately 5.5 billion won of the damages paid by Nonghyup Bank to affected customers. After the information leak incident, Nonghyup Bank paid about 7.9 billion won in damages as a result of 105 lawsuits filed by customers. Nonghyup Bank, having paid the full damages and thereby also releasing KCB from liability, filed a lawsuit in 2022 claiming the right to indemnity for 80% of this amount. The court stated, "Nonghyup Bank appears to have exercised at least some caution, such as requiring the signing and submission of security pledges, to prevent security issues." Regarding KCB, the court found, "KCB was particularly negligent in managing its employee, which led to the information leak, and therefore must bear stricter responsibility." However, the court limited KCB's share of the damages to 70% of the total amount (about 6.4 billion won), rather than the 80% claimed by Nonghyup Bank.

In the damages lawsuit as well, both the first and appellate courts ruled in favor of the plaintiff. Both courts accepted Nonghyup Bank's argument that "KCB, as the employer of the employee, bears liability for damages under the Civil Act or for breach of obligation." However, while the first-instance court recognized the full 18 billion won claimed by Nonghyup Bank, the Civil Division 8-1 of the Seoul High Court, in the appellate trial, only partially accepted the increased claim amount of approximately 45.2 billion won, ruling that KCB must pay 22.8 billion won. Specifically, the court did not accept Nonghyup Bank's additional claim for non-pecuniary damages, such as loss of social reputation and credit. The court explained, "Considering that Nonghyup Bank provided KCB with transaction information, including customer personal data, without properly implementing the measures stipulated by relevant laws and internal regulations, it is reasonable to limit KCB's liability to 60% of the total damages."

Meanwhile, regarding KB Kookmin Card, which suffered the leak of 40 million personal data records at the time, the Supreme Court's First Division last year dismissed the appeal without deliberation, thereby upholding the lower court's partial victory for KB Kookmin Card in its damages claim lawsuit against KCB. As a result, KCB paid KB Kookmin Card approximately 62.4 billion won, which is 70% of the total damages of 89.1 billion won.

© The Asia Business Daily(www.asiae.co.kr). All rights reserved.