Personal information of 201 delivery riders left “unprotected” ... Baemin: “Not our service”

[Financial News] Personal information, including names and phone numbers, of about 201 Baedal Minjok riders appears to have been exposed in a way that allowed outsiders to view it without any separate authentication. The problem reportedly occurred on a site believed to have been operated independently by a delivery agency, and personal information could reportedly be accessed simply by adding a specific path to the web address. The site has since been shut down.
According to the IT industry on the 15th, external users were reportedly able to access a data folder containing the names and phone numbers of Baedal Minjok riders on a site believed to be operated by domestic delivery agency Company A. The exposed personal information is estimated to pertain to about 201 people, based on combinations of rider IDs and names.
The site was operated as a way for riders to check their delivery performance by entering their names, the last digits of their phone numbers, passwords and other information. Users had to be authenticated to check their performance, but the data folder containing personal information was reportedly accessible without logging in.
In particular, the folder could reportedly be viewed by adding a specific path to the web address, without using professional hacking techniques or a separate program. The possibility has been raised that appropriate access restrictions were not in place on the path where the personal information was stored.
Company A, believed to be the site's operator, is a delivery agency that handles rider recruitment, dispatch, settlements and management for delivery platforms including Baedal Minjok and Coupang Eats.
Woowa Brothers, the operator of Baedal Minjok, stressed that the matter was not directly related to Baemin. Baemin said, “We understand that this occurred on a site individually created by a particular delivery agency to look up rider-related information for its own purposes,” adding, “The site has since been shut down.”
It added, making clear that “this site is not a service provided or managed by Baemin, and the agency has no personal-information processing outsourcing arrangement with Baemin.”
[email protected] Choi Hye-rim Reporter