Customers caught up in South Korea's string of bank data breaches are organizing damages suits against Shinhan Bank, saying lenders have pledged compensation without explaining how it will work, The Korea Times reported Wednesday. Separately, police said many of the 28 IP addresses linked to the attacks were used to disguise where the hackers were operating from.

What Happened

Seoul law firm Sedam Law is recruiting plaintiffs for a damages suit against Shinhan Bank under the Personal Information Protection Act, according to The Korea Times. The suit would seek between 100,000 won (about $75) and 300,000 won per plaintiff. A victims' group formed on an online community hosted by Naver is pursuing its own class action against the bank.

Seven financial firms have reported breaches. Shinhan Bank's is the largest, at about 25,000 customers, while KB Kookmin Bank reported 119 affected customers and Hana Bank 89. The exposed information includes names, contact details, resident registration numbers, annual income and loan limits.

RelatedCybersecurity Incident at BAE Systems Halts Notices From U.S. Bankruptcy Courts

The banks have pledged full compensation for losses that result directly from the breaches. The operator of the Naver victims' group said Shinhan has promised to cover confirmed losses but has not explained what would count as a loss or how customers could make a claim. A banking industry official told the paper that individual lenders struggle to set their own standards and that regulators and the industry should agree on common compensation rules.

In a separate Yonhap report carried by The Korea Times, police said a significant share of the 28 IP addresses identified by the Financial Supervisory Service had been used to hide the hackers' whereabouts. Investigators are tracing the attack path with foreign counterparts. The watchdog has shared the addresses and their countries with financial companies and warned that the attackers may be connecting indirectly.

Why It Matters

The lawsuits move the breaches from a regulatory and criminal matter into a question of liability. Resident registration numbers are a core identifier in South Korea and cannot easily be changed, and combined with income and loan-limit data they give fraudsters detailed material for targeted scams. Hwang Sung-ho, a manager at Nord Security Korea, told The Korea Times that such combined data lets criminals craft highly tailored fraud, particularly with AI-assisted phishing.

That is why the compensation question matters. Most customers have not lost money yet, and the harm may show up later as fraud that is hard to link back to the breach. Without a shared definition of a loss, each bank could treat claims differently.

Context

The Primary Wire reported Tuesday that police had assigned 28 investigators to the case as the number of affected people reached about 66,000. The breaches began coming to light Oct. 1 with Shinhan's disclosure and have been tied to a single attacker. The suggestion that the attacker used ARTEX, an AI penetration-testing tool, has not been confirmed.

President Lee Jae Myung told his cabinet Tuesday to inspect security across national core infrastructure and the private sector and to accelerate AI technology built for cybersecurity, according to The Register. He cited recent breaches at financial and public institutions and called for a security overhaul suited to the AI era.

What to Watch

Key questions are whether Sedam Law files the Shinhan suit and how many plaintiffs join, and whether financial regulators step in to set an industry-wide compensation standard. Police efforts to trace the relayed connections through international cooperation could also determine whether the attacker is ever identified.