[ISN] NCSoft to Appeal Ruling on Data Theft Case

[InfoSec News]

http://times.hankooki.com/lpage/200604/kt2006043016491310160.htm

By Kim Tae-gyu
Staff Reporter
04-30-2006 

NCSoft, Korea¡¯s biggest online game developer, is likely to appeal
last week¡¯s verdict that mandated it to pay 500,000 won ($530) to
five holders of hacked accounts for cyber game ``Lineage II.¡¯¡¯

``We cannot accept the ruling because there was no report of actual
damage from the case, which involves just the potential risk of
information leakage,¡¯¡¯ NCSoft spokeswoman Lee Hwa-su said.

Last Friday, the Seoul District Court ordered NCSoft, the maker of the
famous role-playing game Lineage II, to pay out 500,000 won to five
plaintiffs, who lodged a civil complaint last autumn.

NCSoft is expected to receive the notice of the ruling this week or
next. It may at least indirectly affect two similar cases filed by
about 8,500 subscribers to Lineage I, the precedent for Lineage II,
and by 414 against Kookmin Bank, the nation¡¯s biggest lender.

In its ruling, the court said that NCSoft managed personal information
in a manner that made it vulnerable to leakage.

While conducting a regular game upgrade in May 2005, NCSoft failed to
encrypt a database log file that contained usernames and passwords,
the court observed.

As a result, the account data of numerous Lineage II subscribers, who
logged onto the online game during May 11 to May 16 last year, were
available at a computer used for the game.

Five subscribers filed a lawsuit last autumn, seeking 5 million won
each in compensation and could partially win the case in a half-year
litigation last Friday.

But NCSoft still denies its responsibility for the plaintiffs, who the
company claims have failed to prove any practical damages from the
data leakage.

``The account data in question were kept in a computer file, where
even an expert would struggle to find out, for very short period of
time or six days at longest,¡¯¡¯ Lee said.

``There is little likelihood that the data was leaked outside and we
have yet to receive any damage report from it. We think this is a
different case compared to other identity theft,¡¯¡¯ she said.

Observers also point out NCSoft would not comply with the verdict,
which might cause the company to collapse due to resultant court
actions.

``Should NCSoft obey the compensation ruling, other Lineage II users
would try to gain windfalls by taking the firm to the court. How can
the outfit take such a risk?¡¯¡¯ asked Han Ik-hee, an analyst at
Prudential Securities.

Indeed, subscribers who pay a monthly fee of 29,600 won for the
Lineage II membership amount to 1 million, the potential beneficiary
of the compensation verdict.

The legal battle marks back-to-back bad news for NCSoft, which already
suffered from setbacks due to the identity theft case related to
Lineage I, which caught the nation off guard early this year, and
triggered lawsuits by roughly 8,500.

Complaints piled up in February that hackers were stealing private
data from millions of Korean people. The stolen data is believed to be
have been collected mostly by Chinese crackers, who used it to sign up
for Lineage I.