"Personal Information Leaked in Hacking... Mere Anxiety Not Subject to Compensation"

The Supreme Court has ruled that mere anxiety, rather than concrete and actual damage, is not subject to compensation even if personal information is leaked due to a hacking incident. On December 4, 2025, the Supreme Court's Civil Division 2 (Presiding Justice Oh Kyungmi) upheld the lower court's ruling against the plaintiff, Mr. A, in a damages lawsuit filed against Happy Campus operator Agentsoft (2023Da311184).

The Supreme Court has ruled that mere anxiety, rather than concrete and actual damage, caused by personal information leakage due to a hacking incident is not subject to compensation. The Asia Business Daily Database

[Facts]

In September 2021, Happy Campus suffered a hacking incident that resulted in the leak of email addresses and passwords of approximately 400,000 members. Mr. A, a member of Happy Campus, filed a lawsuit claiming 300,000 won in statutory damages and delayed interest, asserting that he suffered emotional distress due to the personal information leak.

[Lower Court Rulings]

The court of first instance dismissed Mr. A's claim. The first-instance court stated, "The leaked passwords had been encrypted in advance," and added, "It is difficult to conclude that the mere leak of email addresses exposed the data subjects to concrete and foreseeable risks." The court further explained, "Agentsoft reported the personal information leak incident to the Personal Information Protection Commission and the Cyber Investigation Bureau of the National Police Agency immediately after the incident, blocked the illegal access route, and sent a hacking notification to Mr. A requesting a password change," concluding, "It is difficult to recognize that Mr. A suffered emotional distress warranting compensation."

The appellate court upheld the first-instance ruling. The appellate court stated, "If Agentsoft had properly fulfilled its duty to take safety measures, there is a likelihood that the personal information leak could have been prevented." However, it also noted, "A violation of the duty to take safety measures cannot be equated with the personal information leak itself, and it cannot be concluded that Mr. A's personal information was leaked due to gross negligence on the part of Agentsoft."

[Supreme Court Ruling]

The Supreme Court stated, "The purpose of the Personal Information Protection Act is not to recognize a duty to compensate for damages even in cases where it is clear that no damage has occurred," and dismissed Mr. A's appeal, thereby confirming the lower court's (appellate court) ruling.

Reporter Lee Sangwoo, The Law Times

※This article is based on content supplied by Law Times.