MetaM discloses breach of customer-support systems, reports to KISA
Phone numbers and consultation conversations were improperly accessed or taken in some cases, MetaM said, after a service outage led it to detect the intrusion.
South Korean customer-support service company MetaM has disclosed that some of its customer-support systems, used to handle consultation work outsourced by client companies, were breached. The company said phone numbers and consultation conversation contents were confirmed to have been improperly viewed or taken out of its systems in some cases, according to dailysecu.com.
MetaM became aware of the intrusion after a customer-support service outage at 6:03 a.m. on November 12, 2026. It then found that some services had seen abnormal access before the outage.
The systems affected or under investigation also store names, email addresses, addresses and birth dates depending on each client company's data items, but not all of this data is confirmed leaked, the company said.
MetaM said it blocked the attacking IP, isolated affected or suspected servers, restricted network and client connections, and changed administrator passwords for servers, virtualization systems and network equipment.
The company completed a breach report to the Korea Internet & Security Agency (KISA) at 3:44 a.m. on November 13 and posted a notice about the data leak on its website on November 14. Affected client companies have been notified, and MetaM said it will inform data subjects and clients of the scope once the investigation concludes.
Quick answers
What data was affected in the MetaM breach?
Phone numbers and consultation conversation contents were confirmed to have been improperly viewed or taken in some cases. Names, email addresses, addresses and birth dates are also stored on affected or investigated systems depending on each client's data items, but not all of that data is confirmed leaked.
When did MetaM report the breach to KISA?
MetaM completed its breach report to the Korea Internet & Security Agency at 3:44 a.m. on November 13, 2026.
What did MetaM do after detecting the intrusion?
It blocked the attacking IP, isolated affected or suspected servers, restricted network and client connections, and changed administrator passwords for servers, virtualization systems and network equipment.