Exploited security flaw in Jinhaksa's Catch leaks seven types of member data
From March 20 to 23, 2026, member information was leaked from Jinhaksa's recruitment platform Catch through unauthorized access exploiting a security vulnerability in a specific CatchCampus page. The seven types of data leaked included gender, date of birth, mobile phone number, address, email, ID, and internal member management data. The company suspended the page and applied a security patch.
Key facts
- Affected organization
- Jinhaksa
- Incident type
- Data breach
- Occurred / detected
- 2026-03-20
- Scale of damage
- Seven types of member information
- Cause / method
- Unauthorized access exploiting a security vulnerability in a specific CatchCampus page
- Location
- South Korea
If your data was exposed
Exposed dataPhone numberEmailAddressDate of birthUsername
- Change your password, and also change it on any other site where you use the same one. Turn on two-factor authentication if available.
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organization’s official website or app.
- If you’ve suffered harm, report it. Call 118 (no area code) for privacy violations, contact the police for financial losses, and apply for dispute mediation to seek compensation.Personal Information Infringement Report Center ↗Korean National Police Agency cybercrime report ↗Personal Information Dispute Mediation Committee ↗
Timeline
- Unauthorized access exploiting a security vulnerability in a specific CatchCampus page began.
- By this date, seven types of member information had been leaked through the unauthorized access.
- It came to light that the company had suspended the page and applied a security patch.
2 related reports
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.