Victims have filed the first damages lawsuit over Coupang's massive personal data leak.
According to the legal community on the 1st, 14 Coupang users including a person identified as A filed a damages suit against Coupang with the Seoul Central District Court that day. They set 200,000 won per person as compensation for mental distress.
The plaintiffs, including A, say it is clear that Coupang's management of user information was inadequate. They argue Coupang revealed the leak only after recognizing, five months later, that there had been unauthorized access to users' personal information from an overseas server since June this year.
They also argued that Coupang violated obligations under the Personal Information Protection Act and must compensate for damages. Under current law, unless a company proves the absence of intent or negligence, it cannot avoid liability.
The scale of the class-action damages suits is expected to grow. After the data leak of Coupang customer information was revealed on the 29th of last month, online communities preparing class actions opened one after another on major portal sites.
According to the National Assembly and others, personal information of 33.7 million members was leaked at Coupang for about five months from June to recently. An analysis said an internal employee exploited a long-valid authentication key that had been left unattended to steal 33.7 million items of personal information.
Some say Coupang may face the largest damages payout ever. With 33.7 million accounts leaked, even if 10 million people—about one-third of the affected accounts—claim 200,000 won each for mental distress, the total would come to 2 trillion won.
Choi Kyung-jin, a professor of law at Gachon University, said, "Given the large number of people and the fact that some information has already been leaked, in terms of lawsuits alone it will be enormous in scale."