Travel booking platform discloses two data leak incidents
Company says an attacker accessed customer and guide data via a signup exploit, while a separate review-page flaw exposed reservation details.
A travel booking platform disclosed on November 6 that it had suffered two separate personal data leak incidents, one caused by an external attack and one by a development error on its review page, according to a notice signed by CEO Cho Hyun-soo.
The company said an outside attacker signed up as a member from around 3:30 p.m. on November 4 and exploited security weaknesses in some service functions to view other customers' and guides' information without authorisation. Exposed customer records included names, email addresses and phone numbers, traveller details entered at booking, companions' surnames, given names, ages and genders, payment amounts, and order information such as product names, travel dates and party size. Some customers also had voucher files or customer-service chat logs leaked or possibly leaked, the company said.
Guide data viewed included names, nicknames, photos, introductions and interview answers, and for some guides email addresses, phone numbers and KakaoTalk IDs. The same attack generated cancellation requests on some orders that customers had not made; the company said it restored all of them that day. It blocked the attacker's access and the leak path, locked the account used, and reported the incident to the Korea Internet & Security Agency and the Personal Information Protection Commission, with which it says it is cooperating.
Review page exposed booking data
Separately, the company said a development error on a review page meant reservation data was not displayed on screen but was included in the page data, making it accessible to visitors or search engines. The company deleted customer reservation data from the review page the day it identified the problem, masked reviewer names the following day, and asked search engines and the Internet Archive to remove the data. It said on November 7 that file paths for reviewers' profile photos had also been included.
According to dailysecu.com, the company said resident registration numbers, passport numbers, dates of birth, card numbers, bank account numbers and passwords were not confirmed as leaked. The total number of affected people and whether the two incidents overlap were not disclosed.
Quick answers
What information was leaked in the attack?
Customer names, emails, phone numbers, traveller and companion details, payment amounts and order information, plus guide profiles and, for some, contact details.
Was financial data exposed?
The company said resident registration numbers, passport numbers, birth dates, card numbers, bank accounts and passwords were not confirmed as leaked.
Which authorities were notified?
The company reported the incident to the Korea Internet & Security Agency and the Personal Information Protection Commission.