Unauthorized access to Hanpass API exposes customer data and original certificates
On November 1, 2026, unauthorized access through Hanpass's API exposed Hanpass Mobile subscriber information and original issued certificates. The exposed data included names, nationalities, phone numbers, addresses, certificates of income, and certificates of alien registration. The company blocked access, strengthened API key authentication, and reported the incident to the relevant authorities, and is investigating the number of people and documents affected.
Key facts
- Affected organization
- Hanpass
- Incident type
- Data breach
- Occurred / detected
- 2026-11-01
- Scale of damage
- Not confirmed
- Cause / method
- Unauthorized access through an API
- Location
- South Korea
If your data was exposed
Exposed dataNamePhone numberAddress
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organization’s official website or app.
- If you’ve suffered harm, report it. Call 118 (no area code) for privacy violations, contact the police for financial losses, and apply for dispute mediation to seek compensation.Personal Information Infringement Report Center ↗Korean National Police Agency cybercrime report ↗Personal Information Dispute Mediation Committee ↗
Timeline
- Unauthorized access through an API exposed subscriber information and original issued certificates.
- The personal data breach became public, along with measures to block access, strengthen API key authentication, and report the incident to the relevant authorities.
- An investigation into the number of people affected and documents exposed was ongoing.
4 related reports
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.