South Korean mobile gift certificate (coupon) issuer Giftiel, part of Lotte Group, has suffered a hacking incident that exposed customer personal data. This is no ordinary breach limited to names, phone numbers and email addresses. Account numbers that customers entered themselves when requesting coupon refunds have also leaked, fueling concerns the data could be used for financial fraud.
Spoon, the operator of Giftiel, said in a notice posted on its website on the 22nd that it had confirmed some customer information was leaked through unauthorized external access. The four leaked items are names, mobile phone numbers, email addresses and refund account numbers. Those affected are not all users but customers who personally entered bank account details to receive gift certificate refunds, according to the company. The exact scale of the leak is still being tallied.
Spoon is a wholly owned subsidiary of Daehong Communications, Lotte Group’s advertising affiliate. Giftiel issues and sells mobile gift certificates for Lotte-affiliated restaurant brands such as Lotteria and Angel-in-us, and also handles inquiries about the use and refund of Lotteria vouchers purchased from other sellers. Its corporate platform Giftiel Biz, used for bulk distribution of promotional prizes and employee gifts, carries about 3,000 products from some 150 brands, including Lotte Mart, Lotte Cinema, Starbucks and Baemin. Observers say the fallout could be significant because the breach occurred in accounts tied directly to payment and refund functions.
After detecting the incident, Spoon blocked the internet protocol (IP) addresses used in the attack and strengthened system access controls. It reported the incident to specialized security agencies and relevant government ministries, requested an investigation, and is expanding database (DB) access monitoring and taking other measures to prevent a recurrence. Affected customers are being notified individually by text message (MMS).
To guard against misuse of account information, the company advised users to suspend payments temporarily and check their accounts through the Account Information Integrated Management Service (Payinfo) or identity theft prevention services. It also urged caution over text messages (smishing), emails and phone calls (phishing) from unknown sources, and warned against clicking suspicious links. A Daehong Communications official said, “We are confirming the scale of the damage, and specific compensation measures have not yet been finalized,” adding, “We will do our best to prevent additional damage and a recurrence.”
The incident is raising questions about the information security systems of major conglomerate affiliates more broadly. Spoon had promoted Lotte Group’s security stability and financial soundness on its website. As of the 25th, the website was in fact blocked, citing an “emergency system security check.” Industry watchers say there needs to be a review of how well the affiliate background and public relations messaging matched actual security levels.
South Korea has seen a series of major data breaches recently. Following the leak of SK Telecom USIM data in April last year and Coupang’s large-scale customer data breach in November of the same year, 16 financial companies suffered simultaneous artificial intelligence (AI) hacking incidents this October. The Giftiel case differs from earlier ones in that the leaked items include financial information. Names and contact details are the raw material for smishing, but account numbers, combined with voice phishing or attempted fraudulent payments, can lead directly to financial losses.
Security experts recommend immediately changing passwords not only on the affected site but on all accounts that use the same login credentials, and enabling smartphone verification codes or one-time passwords (OTP) at the login stage. In particular, users who have reused the same ID and password across multiple services should check their access logs with the possibility of a secondary breach in mind.
Because Giftiel is a platform that brokers gift certificates not only for Lotte-affiliated brands but for some 150 outside brands, the leak could spread beyond Lotte Group into a trust problem for the entire coupon distribution ecosystem. Corporate clients that have used Giftiel Biz for corporate promotions and employee benefits should also consider how to respond in managing their business partners. Spoon plans to confirm the scale and route of the breach and then provide further guidance.
Click Here For The Original Source.
——————————————————–
