Golfzon Data Breach Sparks Collective Legal Action in South Korea Victims of the Golfzon data breach have initiated a collective damages lawsuit against the company, marking a growing trend of legal action following a string of high-profile breaches in South Korea. The lawsuit, filed by law firm CK on behalf of 23 plaintiffs, seeks 200,000 won (≈$150) per person in compensation, with plans to expand participation through a Naver-based class-action café. The breach, traced to a November 2023 ransomware attack, exposed the personal data of 2.21 million individuals, including names, phone numbers, emails, dates of birth, and IDs. More sensitive information such as resident registration numbers (5,831 people) and bank account details (1,647 people) was also compromised, heightening risks of identity theft and voice phishing. CK’s complaint alleges negligence on Golfzon’s part, citing violations of the Personal Information Protection Act, including unencrypted storage of data and failure to delete expired records for at least 380,000 users. The firm emphasized the emotional and financial harm suffered by victims, noting that the leaked data remains vulnerable to secondary exploitation. In response to the breach, South Korea’s Personal Information Protection Commission imposed a 7.5 billion won (≈$5.6 million) penalty surcharge and a 5.4 million won fine on Golfzon. While the lawsuit aims to secure compensation, CK’s lead attorney, Choi Jin-nyeong, indicated openness to mediation if Golfzon proactively addresses victim relief. The case follows recent breaches at Tving (OTT streaming) and Duo (matchmaking service), signaling a surge in consumer-driven legal challenges against companies failing to safeguard user data.