Ddarungi Data Leak Victims File Damages Suit Seeking 300,000 Won Per Person

Twenty-three users of Seoul's public bicycle system, Ddarungi, who suffered personal information leaks, have filed a lawsuit for damages against the Seoul Facilities Corporation.

Minbyun-Lawyers for a Democratic Society submitted the complaint to the Seoul Central District Court on the 22nd, representing the Ddarungi users.

The claim amounts to 300,000 won in damages per user.

The legal representatives from Minbyun's Digital Information Committee argued that the corporation violated security measure obligations under Article 29 of the Personal Information Protection Act by leaving the system vulnerable, allowing access to personal information even without authentication tokens.

They also pointed out that the corporation concealed the signs of the personal data leak for nearly two years, thereby violating the notification obligation under Article 34 of the same act.

Minbyun stated that it plans to consider follow-up lawsuits if additional victims express their intent to join the litigation.

According to the police, the Ddarungi app was hacked in June 2024 by two high school students.

Investigations showed that approximately 4.62 million Ddarungi users were affected by the data leak.

The leaked information reportedly included user IDs, mobile phone numbers, dates of birth, genders, weights, email addresses, home addresses, and guardians' mobile phone numbers.

The leak came to light this January while police were investigating a separate case related to a DDoS (Distributed Denial of Service) attack.

The Seoul Metropolitan Government previously requested a police investigation, stating that the corporation took no initial response for nearly two years despite being aware of the personal information leak.

(Photo: Yonhap News)
※ Please note: This article was translated by AI and may contain errors.