ZoomZoomTour hack and review page error expose customer and guide data
An external attacker exploited a service vulnerability at ZoomZoomTour to access customers’ and guides’ names, contact details, booking and travel information without authorisation, and submitted fraudulent cancellation requests for some bookings. A separate development error on a review page also left information about booking holders and their travelling companions accessible externally for about two years. ZoomZoomTour published an account of the incident and its response on 6 November 2026, in its CEO’s name, but did not disclose the total number of people affected.
Key facts
- Affected organisation
- ZoomZoomTour
- Incident type
- Data breach
- Occurred / detected
- Not confirmed
- Scale of damage
- Not confirmed
- Cause / method
- An external attacker’s exploitation of a service vulnerability and a separate review page development error
- Location
- South Korea
If your data was exposed
Exposed dataNamePhone numberUsage & purchase history
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.
- If you’ve suffered harm, report it. Call 118 (no area code) for privacy violations, contact the police for financial losses, and apply for dispute mediation to seek compensation.Personal Information Infringement Report Centre ↗Korean National Police Agency cybercrime report ↗Personal Information Dispute Mediation Committee ↗
Lookup and notice links are official pages found by AI. Make sure the address is on the organisation’s official domain before using it.
Timeline
- ZoomZoomTour published an account of the personal data breach and its response in the name of CEO Cho Hyun-soo.
- Unauthorised access to customer and guide information and the exposure of personal information on a review page for about two years became known; the total number of people affected was not disclosed.
4 related reports
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.