Gmarket security incident history
Hacking, data breaches and other security incidents involving Gmarket, with related coverage.
Gmarket API flaw exploited to leak personal data and misuse e-coupons
900KImpact: 900,000 people reported as affected by the personal data leak
On October 28–29, unauthorized access exploiting a vulnerability in an external service API at Gmarket exposed customers' personal data and e-coupon PINs, and some e-coupons were used without authorization. The exposed data included names, user IDs, phone numbers, email addresses, and addresses. The company blocked the access route, reported the incident to the Korea Internet & Security Agency (KISA), and requested a police investigation; on November 1, it completed full compensation for losses from unauthorized use and payments of 10,000 won in Smile Cash to customers whose personal data was exposed, while replacement of gift certificate PINs was underway.
Related reports: 34 · last report →Unauthorized payments hit Gmarket amid suspected account takeover
Impact: Losses from unauthorized payments
Cases of unauthorized payments suspected to stem from account takeover occurred at Gmarket. Gmarket's CEO explained that the incidents were presumed to be account misuse unrelated to hacking. Gmarket announced full refunds of the unauthorized payment amounts and measures to strengthen security.
Related reports: 7 · last report →