Unauthorised access to Hanpass API exposes customer data and original certificates
On 1 November 2026, unauthorised access through Hanpass's API exposed Hanpass Mobile subscriber information and original issued certificates. The exposed data included names, nationalities, telephone numbers, addresses, certificates of income, and certificates of alien registration. The company blocked access, strengthened API key authentication, and reported the incident to the relevant authorities, and is investigating the number of people and documents affected.
Key facts
- Affected organisation
- Hanpass
- Incident type
- Data breach
- Occurred / detected
- 2026-11-01
- Scale of damage
- Not confirmed
- Cause / method
- Unauthorised access through an API
- Location
- South Korea
If your data was exposed
Exposed dataNamePhone numberAddress
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.
- If you’ve suffered harm, report it. Call 118 (no area code) for privacy violations, contact the police for financial losses, and apply for dispute mediation to seek compensation.Personal Information Infringement Report Centre ↗Korean National Police Agency cybercrime report ↗Personal Information Dispute Mediation Committee ↗
Timeline
- Unauthorised access through an API exposed subscriber information and original issued certificates.
- The personal data breach became public, along with measures to block access, strengthen API key authentication, and report the incident to the relevant authorities.
- An investigation into the number of people affected and documents exposed was ongoing.
4 related reports
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.