[BODY]
Victims of the "Golfzon personal data breach" have launched collective action, including filing damages lawsuits. With personal data breaches continuing unabated — from the streaming service Tving and matchmaking company Duo to now Golfzon — affected users are mounting a series of lawsuits.
According to the legal community on the 29th, the law firm CK filed a damages lawsuit at the Seoul Central District Court that day on behalf of users harmed by the Golfzon data breach. The claim amount is 200,000 won per person, with 23 victims joining the suit. CK plans to recruit additional plaintiffs through the "Golfzon Personal Data Breach Class Action" café it opened on Naver.
In its complaint, CK pointed out that "Golfzon not only neglected its obligations for technical and managerial safety measures under the Personal Information Protection Act, but also stored resident registration numbers and other data without encryption," and that "it failed to destroy the personal data of at least 380,000 people whose retention period had expired, thereby compounding the damage." It particularly criticized that "because the leaked information is exposed to secondary harm such as voice phishing, the mental anguish suffered by subscribers is not light." Under the Personal Information Protection Act, when personal data is leaked due to the intent or negligence of a data handler, the data subject (breach victim) may claim a reasonable amount of damages within a range of up to 3 million won. This stems from the November 2023 leak of personal data of approximately 2.21 million people, which had been stored on a file server within Golfzon's business network, following a ransomware attack (an attack that blocks data and demands money) by an outside hacker. The leaked information included the names, phone numbers, emails, dates of birth and IDs of subscribers and employees. According to CK, resident registration numbers (5,831 people) and account numbers (1,647 people) of some users were also leaked. In connection with this, the Personal Information Protection Commission imposed a fine of 7.5 billion won and a penalty of 5.4 million won.
Choi Jin-nyeong, CK's representative attorney, explained, "Among the Golfzon data breach victims, some had their resident registration numbers as well as credit card information leaked," and "considering that even sensitive information was involved, we set the claim amount at 200,000 won per person." He added, "The damages lawsuit focuses on ensuring that victims are properly compensated," and "if Golfzon actively moves to compensate victims, there is also room for negotiation, including mediation." Although the damages lawsuit against Golfzon is underway, the intent is to keep a channel for dialogue open, given the importance of relief for victims.
