Personal data breach 'domino effect'…Retail industry plugs security holes - 머니투데이

From coffee memberships to e-commerce and food service companies, personal information leakage incidents are occurring one after another in the retail sector. The scale of leaks disclosed by major companies over the past three months alone has exceeded 3 million cases. Although companies are expanding their information protection organizations and increasing investment, security incidents continue to recur at points connected to external systems, raising questions about the effectiveness of customer information management systems.

Recent Breach Details

According to retail industry sources on the 9th, SSG.com identified a personal data breach on the 4th and reported it to the Korea Internet & Security Agency (KISA) on the 5th and to the Personal Information Protection Commission on the 6th. An unauthorized external party exploited an API (Application Programming Interface) vulnerability to access some customer information. The leaked information consisted mostly of customer names and internal customer identification numbers, and the company notified the affected customers individually. No additional damage has been confirmed yet.

Growing Scale of Incidents

In the retail industry, personal data infringement incidents or potential leaks have been successively identified at 29CM starting from late August last month, followed by Halys, Gmarket, Giftel, and Theborn Korea. Simply adding up the leak scales of Gmarket, Halys, 29CM, and Giftel totals approximately 3.83 million cases. The scale by company is 2.76 million for Halys, over 900,000 people for Gmarket, approximately 160,000 cases for 29CM, and 18,359 people for Giftel.

The pathways of the incidents were similar. Customer information inquiry API vulnerabilities were exploited in attacks on 29CM and Gmarket. There was unauthorized access to a cloud service where past membership information had been stored at Halys. At Theborn Korea, circumstances indicating information exfiltration from the backup server of an ERP maintenance vendor emerged.

Financial Damage and Responses

The leaked information has increasingly taken forms linked to financial damage. At Gmarket, in addition to names, contact details, and addresses, e-coupon PIN numbers were leaked, and circumstances confirming that some coupons were used without authorization were identified. Giftel included coupon serial numbers and refund account information among the leaked items.

Companies are increasing security investments. Shinsegae Group established new information security centers at SCK Company and E-Mart24. Hyundai Department Store placed its information security organization directly under the CEO and raised the target proportion of information protection investment relative to IT budget from 7% to 10%. Gmarket also had a high proportion of information protection investment relative to IT investment at 9.7%, but it could not avoid this incident.