A member of an online site sued for damages, saying an email address was leaked in a hacking incident and caused mental harm, but the Supreme Court dismissed the case, saying "no mental harm warranting damages as consolation money occurred."
The Supreme Court's Second Division (Presiding Justice Oh Kyung-mi) said on the 14th that on the 4th of last month it dismissed an appeal in a damages suit filed by A against HappyCampus and finalized the lower court ruling that found HappyCampus had no liability to compensate.
HappyCampus is a site where users can upload and download various reports, theses, test materials, and personal statements. If someone uploads materials, the person earns a fee when another member pays to download them. It is mainly used by college students for reference when writing reports. As of Dec. 21, 2021, membership stood at about 5.56 million.
A joined the site in 2001. The hacking incident occurred in Sept. 2021. The incident led to the leak of personal information, including email addresses and passwords, of about 400,000 members including A. HappyCampus notified members of the hacking and recommended changing their passwords.
After the hacking incident, A said spam emails were being received and that the leak of the password raised concerns of secondary damage such as voice phishing, causing mental harm, and filed a lawsuit seeking 300,000 won in damages.
The first trial dismissed A's claim. The first trial panel found that passwords were encrypted and, although email addresses were leaked, there was no evidence they spread to third parties. A claimed to be receiving "spam that cannot be blocked" after the incident, but the court found the same harm occurred even before the incident.
A appealed the ruling, but the second trial dismissed the appeal. The second trial panel said, "Even if an email address is leaked, it only creates the possibility of receiving unwanted emails, and it is hard to see that any restriction is imposed on the essential function of the email itself."
The Supreme Court said, "By the close of the lower-court pleadings, more than two years after the time of the hacking, no increase in spam emails related to the incident was confirmed," adding, "Even if an email address is leaked, the risk of invasion of privacy or reputation or property damage is low." It concluded, "It is reasonable to find that no mental harm occurred to the plaintiff warranting damages as consolation money due to this incident."