Online firm not liable for data lost in hack attack

A local court ruled against 146,000 users of online shopping mall Auction who filed a class-action suit asking for 150 billion won ($133 million) in compensation from the retailer for not preventing the leak of millions of users’ personal data by a 2008 hackers attack from China. Ending legal dispute more than a year old, the Seoul Central District Court handed down its verdict in its first trial on the issue.

“There’s no evidence that the Auction was lenient about its security countermeasures against hacking,” said Lim Seong-guen, a judge who presided over the case. “It’s not legally mandatory for companies to set up firewalls for their Web sites and considering that there was low credibility over installing firewalls among businesses at that time, it’s hard to say Auction is liable for the breach.”

Though it’s regretful that the online retailer’s Web site was attacked by hackers that led a leak of names, ID numbers, addresses and phone numbers, Lim said Auction was unable to prevent the attack because security technology at that time couldn’t block the hackers. “Though Auction does not bare legal responsibility, it would be desirable if the company takes ethical responsibility and takes appropriate measures for users,” Lim continued.

In the past, courts ruled in favor of subscribers and users who sued a company for information leaks by hacking and secretly selling user information to others. But this time the court ruled in favor of the online marketplace because security technology at the time had not yet caught up to the hackers.

The court judges also reflected on how Auction officials swiftly handled the matters after the incident. It immediately sent notices to users to change their passwords and encrypted users’ information to prevent a possible attack in the future. “Giving points or cutting commission fees for using the online retailer for users is an idea [that Auction can consider],” Lim said.

Victims who filed the suit showed mixed opinions about the ruling. Some said they were disappointed by what they call “the nonsense ruling,” but because they have been become emotionally drained by the much delayed ruling, they will not appeal. Others said they cannot accept the ruling and will appeal. “Let’s boycott against buying goods through Auction,” reads a reply posted on a Naver message board that brought together plaintiffs in the case against the Web site. “Those who make fools of customers should go out of business.”

By Choe Sun-uk, Kim Mi-ju [mijukim@joongang.co.kr]