Exploited security flaw in Jinhaksa's Catch leaks seven types of member data
From 20 to 23 March 2026, member information was leaked from Jinhaksa's recruitment platform Catch through unauthorised access exploiting a security vulnerability in a specific CatchCampus page. The seven types of data leaked included gender, date of birth, mobile phone number, address, email, ID and internal member management data. The company suspended the page and applied a security patch.
Key facts
- Affected organisation
- Jinhaksa
- Incident type
- Data breach
- Occurred / detected
- 2026-03-20
- Scale of damage
- Seven types of member information
- Cause / method
- Unauthorised access exploiting a security vulnerability in a specific CatchCampus page
- Location
- South Korea
If your data was exposed
Exposed dataPhone numberEmailAddressDate of birthUsername
- Change your password, and also change it on any other site where you use the same one. Turn on two-factor authentication if available.
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.
- If you’ve suffered harm, report it. Call 118 (no area code) for privacy violations, contact the police for financial losses, and apply for dispute mediation to seek compensation.Personal Information Infringement Report Centre ↗Korean National Police Agency cybercrime report ↗Personal Information Dispute Mediation Committee ↗
Timeline
- Unauthorised access exploiting a security vulnerability in a specific CatchCampus page began.
- By this date, seven types of member information had been leaked through the unauthorised access.
- It came to light that the company had suspended the page and applied a security patch.
2 related reports
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.