Now Hacked
EN
Data breach

Modetour Network web shell attack leaks personal data of about 3.06 million people

First reported · Last reported · 25 related reports

In June 2024, Modetour Network's website was hit by a web shell attack exploiting a file upload vulnerability, and personal information of about 3.06 million members and non-members was stolen. The leaked data included names, dates of birth, mobile phone numbers, CI and DI values, and the company announced the incident in September despite becoming aware of it that June. The company apologized and asked users to change their passwords, and a sanction by the Personal Information Protection Commission and a damages ruling followed.

Key facts

Affected organization
Modetour Network
Incident type
Data breach
Occurred / detected
Not confirmed
Scale of damage
Personal information of about 3.06 million members and non-members
Cause / method
Web shell attack exploiting a file upload vulnerability
Location
South Korea

If your data was exposed

Exposed dataNamePhone numberDate of birth

  1. Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organization’s official website or app.
  2. If you’ve suffered harm, report it. Call 118 (no area code) for privacy violations, contact the police for financial losses, and apply for dispute mediation to seek compensation.Personal Information Infringement Report Center ↗Korean National Police Agency cybercrime report ↗Personal Information Dispute Mediation Committee ↗

Timeline

  1. The company announced the leak of personal information from its website, apologized and asked users to change their passwords.
  2. The Personal Information Protection Commission disclosed that it had begun an investigation and had received more than 60 dispute mediation applications.
  3. The theft of information on about 3.06 million people, along with inadequate security measures, failure to destroy personal information and delayed notification, was confirmed, and a penalty surcharge and fine were imposed.
  4. A ruling ordering 100,000 won in compensation for the personal data leak was disclosed.
  5. The 100,000 won compensation ruling was upheld on appeal.
  6. It was disclosed that the ruling awarding 100,000 won in compensation for emotional distress was finalized by the Supreme Court.

25 related reports

The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.