Now Hacked
EN
Data breach

Gmarket API flaw exploited to leak personal data and misuse e-coupons

First reported · Last reported · 34 related reports

On October 28–29, unauthorized access exploiting a vulnerability in an external service API at Gmarket exposed customers' personal data and e-coupon PINs, and some e-coupons were used without authorization. The exposed data included names, user IDs, phone numbers, email addresses, and addresses. The company blocked the access route, reported the incident to the Korea Internet & Security Agency (KISA), and requested a police investigation; on November 1, it completed full compensation for losses from unauthorized use and payments of 10,000 won in Smile Cash to customers whose personal data was exposed, while replacement of gift certificate PINs was underway.

Key facts

Affected organization
Gmarket
Incident type
Data breach
Occurred / detected
2026-10-28
Scale of damage
900,000 people reported as affected by the personal data leak
Cause / method
Unauthorized access exploiting a vulnerability in an external service API
Location
South Korea

If your data was exposed

View Gmarket notice ↗

Exposed dataNameUsernamePhone numberEmailAddress

  1. Change your password, and also change it on any other site where you use the same one. Turn on two-factor authentication if available.
  2. Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organization’s official website or app.
  3. If you’ve suffered harm, report it. Call 118 (no area code) for privacy violations, contact the police for financial losses, and apply for dispute mediation to seek compensation.Personal Information Infringement Report Center ↗Korean National Police Agency cybercrime report ↗Personal Information Dispute Mediation Committee ↗

Lookup and notice links are official pages found by AI. Make sure the address is on the organization’s official domain before using it.

Timeline

  1. Indications of unauthorized access to internal services were confirmed from 9:36 a.m. to 5:38 p.m. the following day.
  2. Gmarket confirmed indications of unauthorized registration and use of e-coupons and said it had blocked the unauthorized access route and reported the incident to KISA.
  3. Full compensation for losses from unauthorized e-coupon use and payments of 10,000 won in Smile Cash to customers whose personal data was exposed were completed.
  4. It was disclosed that replacement of gift certificate PINs was underway and that 900,000 people had been reported as affected by the personal data leak.

34 related reports

The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.