INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Gmarket data leak victim receives 10,000 won compensation via Gmarket

| 2026-11-02 01:41 HIGH LOW DATA BREACH
JSON
Executive Summary
AI-generated
Gmarket recently announced that it is taking measures to compensate the affected customers following a customer personal information leak incident. The incident occurred from October 28th to 29th, due to a vulnerability in an external service application programming interface (API) exploited by unauthorized access, resulting in a data leak of customer names, IDs, e-coupon PIN numbers, phone numbers, email addresses, and addresses. Affected customers who experienced financial losses received the full amount of their loss at face value via SmileCash or 10,000 won compensation. Gmarket reported the incident to KISA and the Personal Information Protection Commission on October 29th, while also implementing emergency security measures and conducting e-coupon PIN number replacement work for affected customers.
Technical Mitigations AI-generated
• Replace e-coupon PIN numbers with new ones using a secure random number generator. • Implement API rate limiting to prevent unauthorized access and brute-force attacks on the external service application programming interface (API). • Use encryption for storing sensitive customer information, such as names, IDs, phone numbers, email addresses, and addresses.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope
Incident Timeline
‎2026/10/03
Threat actors exploited a vulnerability in Gmarket's external service API from October 28th to 29th, resulting in the data leak of personal information.
‎2026/11/02
Threat actors used unauthorized e-coupon PIN numbers to target Gmarket customers, prompting the company and relevant authorities to take action.
organisation SmileCash
According to Gmarket, customers who experienced financial losses due to unauthorized use of e-coupons received the full amount of the loss at the face value of the cash equivalent, while customers who did not experience direct e-coupon losses received a total of 10,000 won via SmileCash.
organisation KISA
Gmarket recognized the situation where the e-coupon PIN number was used without consent, and reported the incident to KISA (Korea Internet & Security Agency) and the Personal Information Protection Commission on the same day after recognizing the infringement.
organisation Korea Internet & Security Agency
Gmarket recognized the situation where the e-coupon PIN number was used without consent, and reported the incident to KISA (Korea Internet & Security Agency) and the Personal Information Protection Commission on the same day after recognizing the infringement.
organisation the Personal Information Protection Commission
Gmarket recognized the situation where the e-coupon PIN number was used without consent, and reported the incident to KISA (Korea Internet & Security Agency) and the Personal Information Protection Commission on the same day after recognizing the infringement.
organisation Cybercrime Division
The company plans to report to the police Cybercrime Division as well.
Intelligence Sources
Chosun Economy 2026-11-02