Gmarket security incident history
Hacking, data breaches and other security incidents involving Gmarket, with related coverage.
Gmarket API flaw exploited to leak personal data and misuse e-coupons
900kImpact: 900,000 people reported as affected by the personal data leak
On 28–29 October, unauthorised access exploiting a vulnerability in an external service API at Gmarket exposed customers' personal data and e-coupon PINs, and some e-coupons were used without authorisation. The exposed data included names, user IDs, phone numbers, email addresses and addresses. The company blocked the access route, reported the incident to the Korea Internet & Security Agency (KISA) and requested a police investigation; on 1 November, it completed full compensation for losses from unauthorised use and payments of 10,000 won in Smile Cash to customers whose personal data was exposed, while replacement of gift voucher PINs was underway.
Related reports: 34 · last report →Unauthorised payments hit Gmarket amid suspected account takeover
Impact: Losses from unauthorised payments
Cases of unauthorised payments suspected to stem from account takeover occurred at Gmarket. Gmarket's CEO explained that the incidents were presumed to be account misuse unrelated to hacking. Gmarket announced full refunds of the unauthorised payment amounts and measures to strengthen security.
Related reports: 7 · last report →