Among the three mobile carriers, SK Telecom, the only one that voluntarily reported being hacked, is under pressure for large-scale compensation following a recent decision by the Korea Consumer Agency (KCA). On top of compensating customers with more than 1 trillion won through SIM card replacements and bill discounts, waiving early termination fees, and being hit with a penalty surcharge in the 100 billion won range, the latest consumer dispute mediation decision has emerged as an additional burden. There are growing concerns that this could send a signal across the industry that voluntarily disclosing hacking damage in the future will be a losing proposition.
◇ If the compensation is fully accepted, estimated at 2.3 trillion won
The Consumer Dispute Settlement Commission of the Korea Consumer Agency (KCA) said on the 21st that it decided SK Telecom should pay the equivalent of 100,000 won per applicant in connection with the personal data leak. It ordered a 50,000 won discount on phone bills and 50,000 T-Plus points, which can be used like cash at partner companies, to be provided to those who applied for dispute mediation.
The mediation decision is not legally binding, but observers say it could be reflected as a favorable reference for consumers in future civil lawsuits. SK Telecom said it "will carefully review the mediation details and decide prudently." Assuming SK Telecom fully accepts the proposal, with about 23 million total subscribers, the compensation could reach up to about 2.3 trillion won. Even by the standard of a single incident, the burden could be unusually large in Korea.
Government and National Assembly moves to revise the law to introduce punitive damages for hacking, spurred by the recent Coupang-related hacking incident, are also cited as factors complicating SK Telecom's decision. Retroactive application of punitive damages is impossible, but the market is interpreting that consumer dispute mediation could indirectly create an effect tantamount to punitive damages. For that reason, there is also talk that SK Telecom may not outright reject the proposal but opt for a partial acceptance as a compromise.
◇ "Voluntary reporting" brings disadvantages… industry worries "incentive to conceal grows"
The telecom industry views that if this case cements the perception that "voluntary reporting backfires," it could distort corporations' reporting behavior going forward. SK Telecom has already spent 200 billion to 300 billion won on SIM replacements and was imposed a penalty surcharge of about 134 billion won by the Personal Information Protection Commission. In addition, it carried out customer compensation in the 1 trillion won range through bill discounts and 50% membership partner discounts and accepted early termination fee waivers. It was also penalized with a suspension of new subscriber sales for more than 50 days.
As a result, SK Telecom posted a quarterly operating loss (a 52.2 billion won deficit) in the third quarter for the first time since its founding and decided not to pay dividends. Inside and outside the industry, there are concerns that if the pattern hardens in which SK Telecom, the only one among the three carriers to voluntarily report hacking damage, bears concentrated expense and penalties, corporations may move to conceal damage as much as possible.
By contrast, a view has spread in the industry that KT and LG Uplus were slow to respond after the hacking situations came to light without voluntary reporting. Some even raise suspicions of server disposal. Even after specific details of hacking damage became known, KT continued normal business operations without the suspension of new subscriber sales imposed on SK Telecom. As recognition spreads that all three carriers suffered hacking damage, some predict it will be hard to see a repeat of the sharp drop in operating results for KT or LG Uplus like during the SK Telecom situation. In the industry, there is even talk that "it is smarter to hold out without voluntary reporting."
A telecom industry official said, "All three carriers were hacked, but only SK Telecom, which reported first voluntarily, incurred more than 1 trillion won in expense, while other carriers that did not voluntarily report are operating normally without major expenditure." The stock price trends of the three carriers underscore this. As of the 22nd of this month, SK Telecom, which voluntarily reported the hacking damage, saw its stock fall 5.17% from the start of the year (Jan. 2), while KT and LG Uplus, which did not preemptively report, saw their shares soar. Over the same period, KT rose 20.82% and LG Uplus jumped 47.3%.
The key question is whether SK Telecom will accept the proposal to contain the dispute or reject it and move into a legal battle. In Aug., the Personal Information Dispute Mediation Committee recommended 300,000 won per person in compensation, but SK Telecom did not accept it. Jang Hang-bae, a professor in the Department of Industrial Security at Chung-Ang University, said, "Among the carriers that were hacked, only SK Telecom made a preemptive voluntary report, yet it seems to have faced strong penalties," adding, "If the system is not designed to give advantages to corporations that voluntarily report, the incentive to conceal incidents could grow."