Yegaram Savings Bank, which leaked the personal information of 50,000 customers, has set aside neither a separate liability insurance policy nor reserve funds, according to findings. The bank joined a joint insurance program through the Korea Federation of Savings Banks, but incidents originating on external networks fall outside the coverage, meaning the lender would have to compensate any customer losses with its own funds.
Yegaram Savings Bank joined a personal data breach liability insurance policy through the Korea Federation of Savings Banks but is unlikely to receive a payout for this incident, financial industry sources said on the 15th. "Because we use the federation's shared IT network, we signed up in the form of joint insurance, but this incident occurred through an external solution rather than the shared network, so it is not covered," an official at Yegaram Savings Bank said. "We have no insurance policy of our own and no reserves set aside, so we are discussing how to proceed with compensating the damage."
Of South Korea's 79 savings banks, the 67 that use the federation's shared IT network have signed up for personal data breach liability insurance together with the federation. The coverage limit is up to 2 billion won. The Credit Information Use and Protection Act requires financial firms to buy insurance or mutual aid coverage, or to set aside reserves, so that they can meet liability for damages arising from data breaches. Savings banks can satisfy this obligation by joining the federation's joint insurance program.
The problem is that incidents occurring outside the shared network, on systems operated separately, can be excluded from coverage. Market participants say the gaps in the compensation framework for data breach victims should be addressed now. "Savings banks that use the shared IT network can also build external solutions separately as needed, and many recent hacking cases have occurred on such external solutions," an official at the Korea Federation of Savings Banks said.
Major financial firms are preparing for damage claims by buying their own policies or setting aside reserves. Among the 16 firms that suffered breaches, the eight confirmed to hold personal data protection liability insurance have combined annual coverage limits of 59.62 billion won. Shinhan Bank has the largest at 20 billion won, followed by KB Kookmin Bank, Hana Bank and Hyundai Capital at 10 billion won each. BNK Busan Bank has 5 billion won, DB Savings Bank 1.6 billion won, OK Savings Bank 500 million won, and Streami, the operator of Gopax, 2.52 billion won. Welcome Savings Bank and KDB Capital are setting aside reserves instead of buying insurance.
"Cases in which financial damage from a data leak is proven are not common, so actual insurance claims are rare, but if legal liability for damages is established, we would file a claim with the insurer," an official at a commercial bank said.