External Attack Exposes Around 3,000 Personal Data Records From Korea Minting and Security Printing Corporation’s 'Chak' Local Love Gift Certificate Platform

[Financial News] An incident involving the exposure of personal information belonging to around 3,000 users occurred on Chak, a mobile local love gift certificate platform operated by the Korea Minting and Security Printing Corporation (KOMSCO), after an outsider gained unauthorized access.
According to KOMSCO on the 14th, signs of abnormal access to the Chak system were first detected at around 9:30 a.m. the previous day, the 13th. The corporation immediately identified and blocked IP addresses suspected of being involved in the attack and completely restricted access from overseas IP addresses. It then identified the server targeted in the attack, temporarily suspended the service, and resumed normal operations after taking emergency security measures.
The investigation found that some users’ personal information had been accessed through unauthorized system access by an outsider. As of 6 a.m. on the 14th, seven types of personal information had been confirmed exposed: names, dates of birth, mobile phone numbers, bank account numbers, Connecting Information (CI), email addresses and encrypted card numbers.
The number of people affected was estimated at 3,083. Of these, 3,072 users had two or fewer pieces of information accessed (for example, a name and date of birth, or CI and an encrypted card number), while 11 users had three to four pieces of information exposed. The items exposed varied by individual, and the exact route of the breach, the attack methods and whether any additional data was exposed are still under investigation.
KOMSCO has completed reporting procedures with relevant agencies, including the Korea Internet & Security Agency (KISA), and has launched a security review of its entire system along with a 24-hour intensive monitoring system. With help from outside experts, it plans to analyze system vulnerabilities and improve its access control system.
KOMSCO is also notifying affected users individually and operating a dedicated customer center to receive reports of harm and provide assistance.
A KOMSCO official said, "We feel a profound sense of responsibility and sincerely apologize for an incident at a public institution entrusted with safely protecting the public’s valuable personal information." The official urged users to "be especially cautious about suspicious calls or text messages to prevent secondary harm, such as voice phishing and smishing that exploit the leaked information."
The dedicated Chak customer center is open on weekdays from 9 a.m. to 6 p.m. To minimize customer inconvenience, an additional temporary customer center will also operate from 4 p.m. to 8 p.m. on the 14th.
[email protected] Park Ji-hyun Reporter