Legal Reckoning: Infosys Settles for $17.5M, SK Telecom Faces Per-Victim Fines

The financial and legal repercussions for companies suffering major data breaches are becoming increasingly concrete and severe, as evidenced by two landmark rulings on opposite sides of the globe this week. In the United States, a federal court has approved a multi-million dollar class-action settlement, while in South Korea, a consumer protection agency has issued a direct per-victim compensation order. These cases signal a decisive shift from abstract regulatory risk to immediate financial liability for security failures.

The Infosys McCamish Settlement: A $17.5 Million Lesson

A Georgia federal court has granted final approval to a $17.5 million settlement in a class-action lawsuit against Infosys McCamish Systems LLC (IMS), a U.S.-based subsidiary of Infosys BPM Ltd., which is part of the Indian IT conglomerate Infosys. The lawsuit stemmed from a devastating ransomware attack discovered in November 2023, which crippled IMS's systems for weeks.

The breach exposed highly sensitive personal and financial information belonging to over 6,000 individuals. The vast majority of the affected individuals were customers of Bankers Life, a life insurance company that utilized IMS for policy administration services. The compromised data included names, Social Security numbers, dates of birth, financial account information, and medical details—a comprehensive dataset ripe for identity theft and fraud.

The plaintiffs argued that Infosys McCamish failed to implement reasonable cybersecurity measures, making the company negligent in its duty to protect the data it processed. The $17.5 million settlement fund will be used to provide compensation to class members for out-of-pocket losses, costs of credit monitoring and identity theft protection services, and other expenses related to the breach. The court's approval underscores the willingness of the U.S. judiciary to hold service providers accountable for downstream breaches that impact their clients' customers, a critical point for the B2B software and services sector.

SK Telecom's Direct Compensation Order: A Model for Victim Redress?

Meanwhile, in South Korea, the Korea Consumer Agency (KCA) has taken a more granular approach to victim compensation. The agency has ordered SK Telecom, the country's dominant telecommunications provider, to pay 90,000 Korean won (approximately $67) to each of 58 identified victims of a sophisticated hacking campaign.

The incident involved threat actors exploiting security vulnerabilities to gain unauthorized access to user accounts. The stolen personal data was subsequently used to carry out financial fraud against the victims. The KCA's investigation concluded that SK Telecom had not deployed sufficient security safeguards to prevent the account takeovers, constituting a failure in its obligation to protect consumer data.

This order is particularly notable for its mechanism. Rather than a blanket fine paid to a government coffers, it mandates direct compensation to individual victims, creating a tangible link between corporate failure and consumer redress. The KCA's action reflects a growing regulatory philosophy in some jurisdictions that emphasizes restorative justice for victims over purely punitive measures against companies.

Analysis: The Evolving Landscape of Breach Liability

These two cases, though geographically and procedurally distinct, converge on a central theme: the cost of a data breach is increasingly being quantified in direct, victim-centric terms. For the cybersecurity industry, several key implications emerge:

1. Escalating Cost of Failure: The direct costs of settlements and compensation orders are becoming a standard line item in breach aftermaths, supplementing regulatory fines, forensic investigation costs, and system remediation expenses. The $17.5 million settlement for a breach affecting 6,000 individuals sets a notable benchmark for per-victim liability in class-action contexts.
2. Regulatory Diversification: The SK Telecom case highlights that liability is not limited to courts. Consumer protection agencies and data privacy regulators worldwide are arming themselves with the authority to order direct compensation, expanding the avenues through which victims can seek redress.
3. Third-Party Risk in Sharp Focus: The Infosys McCamish breach is a textbook example of supply chain risk. Bankers Life's customers were impacted not by a failure at the insurer itself, but at its service provider. This will intensify scrutiny of vendor security assessments and contractually mandated security standards in service agreements.
4. The Quantification of Harm: The KCA's specific award of $67 per victim represents an attempt to quantify the tangible harm and inconvenience suffered from data misuse for fraud. This challenges the traditional defense that mere exposure of data does not constitute concrete harm.

Conclusion

The legal reckoning for data breaches is accelerating. The combined message from the U.S. District Court in Georgia and the Korea Consumer Agency is clear: companies are expected to be custodians of personal data, and failures in that duty will be met with significant, direct financial consequences. For CISOs and risk managers, these cases reinforce the necessity of robust security programs not merely as a technical imperative, but as a critical financial and legal safeguard. As jurisdictions continue to refine their approaches to victim compensation, the business case for proactive cybersecurity investment has never been stronger. The era where breach costs were nebulous and indirect is giving way to an era of specific, court-ordered and regulator-mandated payments to those harmed.