From coffee memberships to e-commerce and food service companies, personal information leakage incidents are occurring one after another in the retail sector. The scale of leaks disclosed by major companies over the past three months alone has exceeded 3 million cases. Although companies are expanding their information protection organizations and increasing investment, security incidents continue to recur at points connected to external systems, raising questions about the effectiveness of customer information management systems.
According to retail industry sources on the 9th, SSG.com identified a personal data breach on the 4th and reported it to the Korea Internet & Security Agency (KISA) on the 5th and to the Personal Information Protection Commission on the 6th. An unauthorized external party exploited an API (Application Programming Interface) vulnerability to access some customer information. The leaked information consisted mostly of customer names and internal customer identification numbers, and the company notified the affected customers individually. No additional damage has been confirmed yet.
In the retail industry, personal data infringement incidents or potential leaks have been successively identified at 29CM starting from late August last month, followed by Halys, Gmarket, Giftel, and Theborn Korea. Simply adding up the leak scales of Gmarket, Halys, 29CM, and Giftel totals approximately 3.83 million cases. The scale by company is 2.76 million for Halys, over 900,000 people for Gmarket, approximately 160,000 cases for 29CM, and 18,359 people for Giftel.
The pathways of the incidents were similar. Customer information inquiry API vulnerabilities were exploited in attacks on 29CM and Gmarket. There was unauthorized access to a cloud service where past membership information had been stored at Halys. At Theborn Korea, circumstances indicating information exfiltration from the backup server of an ERP maintenance vendor emerged. The scope of security management has expanded not only to internal company systems but also to external services and partner companies.
The leaked information has also increasingly taken forms linked to financial damage. At Gmarket, in addition to names, contact details, and addresses, e-coupon PIN numbers were leaked, and circumstances confirming that some coupons were used without authorization were identified. Giftel included coupon serial numbers and refund account information among the leaked items. Retailers collect names, contact details, addresses, and purchase histories throughout the processes of purchasing, delivery, and membership point accumulation, so the scope of damage is wide when an incident occurs.
As this situation repeats, companies are increasing their security organizations and investments. Shinsegae Group established new information security centers at SCK Company and E-Mart24. Hyundai Department Store placed its information security organization directly under the Chief Executive Officer (CEO) and raised the target proportion of information protection investment relative to IT budget from 7% to 10%.
Gmarket also had a high proportion of information protection investment relative to IT investment at 9.7%, but it could not avoid this incident. Pointers indicate that management capabilities are needed to proactively identify vulnerabilities in areas difficult for companies to directly control, such as external APIs, clouds, and partner company servers, rather than just budget size. There are also voices saying that the entire process from collection to storage and disposal must be periodically inspected.
An industry official said, "As online transactions and membership services expand, the customer information and security threats that companies must manage increase accordingly," adding, "It is difficult to restore customer trust by responding only after an incident occurs, so efforts are needed to regularly inspect data management systems and reduce security blind spots."
in LIVING
