Now Hacked
EN-GB
Data breach

Gmarket API flaw exploited to leak personal data and misuse e-coupons

First reported · Last reported · 34 related reports

On 28–29 October, unauthorised access exploiting a vulnerability in an external service API at Gmarket exposed customers' personal data and e-coupon PINs, and some e-coupons were used without authorisation. The exposed data included names, user IDs, phone numbers, email addresses and addresses. The company blocked the access route, reported the incident to the Korea Internet & Security Agency (KISA) and requested a police investigation; on 1 November, it completed full compensation for losses from unauthorised use and payments of 10,000 won in Smile Cash to customers whose personal data was exposed, while replacement of gift voucher PINs was underway.

Key facts

Affected organisation
Gmarket
Incident type
Data breach
Occurred / detected
2026-10-28
Scale of damage
900,000 people reported as affected by the personal data leak
Cause / method
Unauthorised access exploiting a vulnerability in an external service API
Location
South Korea

If your data was exposed

View Gmarket notice ↗

Exposed dataNameUsernamePhone numberEmailAddress

  1. Change your password, and also change it on any other site where you use the same one. Turn on two-factor authentication if available.
  2. Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.
  3. If you’ve suffered harm, report it. Call 118 (no area code) for privacy violations, contact the police for financial losses, and apply for dispute mediation to seek compensation.Personal Information Infringement Report Centre ↗Korean National Police Agency cybercrime report ↗Personal Information Dispute Mediation Committee ↗

Lookup and notice links are official pages found by AI. Make sure the address is on the organisation’s official domain before using it.

Timeline

  1. Indications of unauthorised access to internal services were confirmed from 9:36 am to 5:38 pm the following day.
  2. Gmarket confirmed indications of unauthorised registration and use of e-coupons and said it had blocked the unauthorised access route and reported the incident to KISA.
  3. Full compensation for losses from unauthorised e-coupon use and payments of 10,000 won in Smile Cash to customers whose personal data was exposed were completed.
  4. It was disclosed that replacement of gift voucher PINs was underway and that 900,000 people had been reported as affected by the personal data leak.

34 related reports

The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.