Now Hacked
EN-GB
Data breach

Papa John's Korea order page exposes customer personal data

First reported · Last reported · 9 related reports

It was found that changing a number in the URL of Papa John's Korea's order page exposed other customers' order histories and personal information without login or authentication. Concerns were raised that about 37 million customer records from the past nine years, including names, addresses and card numbers, may have been leaked. It emerged that the company had become aware of the problem in July 2024 but had not reported it to the Korea Internet & Security Agency (KISA), and the Personal Information Protection Commission (PIPC) launched an investigation.

Key facts

Affected organisation
Papa John's Korea
Incident type
Data breach
Occurred / detected
Not confirmed
Scale of damage
Possible leak of about 37 million customer records from the past nine years
Cause / method
Lack of authentication allowing access to other customers' data simply by changing a number in the order page URL
Location
South Korea

If your data was exposed

Exposed dataNameAddressCard detailsUsage & purchase history

  1. Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.
  2. Turn on payment alerts in your card issuer’s app, and if you see a charge you don’t recognise, ask the issuer to block and reissue the card.
  3. If you’ve suffered harm, report it. Call 118 (no area code) for privacy violations, contact the police for financial losses, and apply for dispute mediation to seek compensation.Personal Information Infringement Report Centre ↗Korean National Police Agency cybercrime report ↗Personal Information Dispute Mediation Committee ↗

Timeline

  1. The Personal Information Protection Commission (PIPC) launched an investigation into the Papa John's Korea customer data leak.
  2. Concerns were raised that about 37 million customer records from the past nine years may have been leaked.
  3. It emerged that the company had become aware in July 2024 of the data exposure via URL manipulation but had not reported it to the Korea Internet & Security Agency (KISA).

9 related reports

The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.