South Korean electric vehicle charging operator Chabi disclosed on July 26 that an illegal hacking attack on July 23 exposed 298,333 personal information records belonging to its members. The company confirmed it blocked the attacker's access path upon discovery and reported the incident to South Korea's Personal Information Protection Commission (PIPC) and the Korea Internet & Security Agency (KISA). Affected customers can query their exposure status on Chabi's website starting today, with direct notifications going out July 27.
What Happened
The intrusion occurred on July 23, 2026. Chabi did not disclose the initial access vector, the duration of attacker dwell time before detection, or whether the breach was discovered internally or reported by a third party. The three-day gap between incident and public disclosure is consistent with South Korea's statutory notification requirements under the Personal Information Protection Act (PIPA), which obligates data controllers to notify both the PIPC and affected data subjects without undue delay after becoming aware of a breach.
Chabi's response followed a recognizable containment sequence: identify and block the attack path, notify regulators, then stand up a customer-facing exposure lookup tool. The company has framed the incident as contained, emphasizing that the attack path was closed "immediately upon discovering the breach." That framing tells defenders very little about scope. Blocking a known path does not establish that the attacker lacked others, nor does it confirm the absence of persistence. Absent a published forensic timeline, treat the containment claim as an unverified starting point rather than a resolution.
The dual notification to PIPC and KISA is standard for Korean incidents of this scale and means a regulatory review is effectively guaranteed. Expect further detail, and potentially administrative penalties, once that process concludes.
What Was Taken
Chabi published an unusually granular breakdown of the 298,333 exposed records, which is worth reading closely because the tiers carry very different risk profiles:
- 164,858 records: email address only
- 131,411 records: email address plus encrypted password
- 1,235 records: email address, encrypted name, encrypted contact information, gender, date of birth
- 829 records: email address, encrypted name, encrypted contact information, encrypted password, gender, date of birth
The company stated that resident registration numbers (RRNs), passport numbers, and card or account numbers were not compromised. For a Korean breach, the absence of RRNs is the single most consequential detail. The RRN is a lifetime, non-rotatable national identifier that underpins identity verification across Korean financial and government services, and its exposure is what typically escalates a Korean breach from nuisance to durable identity-theft exposure. Its absence here materially caps the downside.
Two details deserve scrutiny. First, gender and date of birth appear in plaintext across 2,064 records. Those fields are not encrypted, and combined with an email address they form a usable profile for correlation against other breach corpora and for targeted social engineering. Second, Chabi asserts that encrypted values are "stored in a way that makes it impossible to decrypt into a readable format" and therefore "cannot be used for personal identification or login exploitation."
That phrasing is doing significant work, and defenders should treat it cautiously. It most plausibly describes one-way hashing rather than reversible encryption, which for passwords would be appropriate practice. But "impossible to decrypt" is a claim about implementation, not a property of encryption generally, and its strength depends entirely on undisclosed specifics: which algorithm, whether passwords were salted per-user, and what work factor was applied. A modern memory-hard function with per-user salts substantiates the claim. An unsalted fast hash such as MD5 or SHA-1 does not, and would leave 132,240 password records vulnerable to offline cracking at scale. Chabi has published none of these details. Notably, the company still urged affected members to change their passwords immediately, which is the correct advice and sits somewhat at odds with an assertion of zero exploitability.
Why It Matters
EV charging networks are a maturing target class sitting at the intersection of critical infrastructure, mobility data, and consumer identity. Chabi's exposure is predominantly credential-shaped: roughly 132,000 email and password pairs, plus another 165,000 bare email addresses. That composition points at two follow-on threats regardless of hash strength.
The first is credential stuffing. Even if Chabi's own hashes hold, the email list alone is a validated target roster of Korean EV owners. Attackers routinely pair such lists with credentials sourced from unrelated breaches and replay them against higher-value services. The second is targeted phishing. A confirmed breach with a public notification cycle is an ideal pretext window. Expect lures impersonating Chabi's own exposure-check tool and password-reset flow within days, aimed at harvesting the credentials the breach may not have yielded directly.
There is also a demographic signal worth noting. An EV charging membership base is a reasonable proxy for higher-income, higher-value consumers, which raises the resale value of this list relative to its size. Three hundred thousand records is not a headline-grabbing volume, but the targeting quality is above average.
For defenders in the mobility and charging sector, the structural lesson is that customer account databases in this space are being actively pursued. Charging operators have accumulated consumer identity and payment infrastructure at a pace that has often outrun their security maturity, and they should assume they are in scope.
The Attack Technique
Chabi has not disclosed the initial access vector, and no threat actor attribution has been made public. The available reporting describes only an "illegal hacking attack" and confirms that an attack path was identified and blocked. No ransomware component, extortion demand, or leak-site posting has been reported.
What the data shape suggests is worth stating as inference rather than fact. The exposure pattern, a large volume of email and password-hash pairs with only a thin tier of fuller profile records, is characteristic of direct extraction from an authentication or member-account datastore rather than a broad compromise of transactional or billing systems. The stated absence of card and account numbers reinforces that read: payment infrastructure appears to have been outside the compromised scope. Vectors consistent with this pattern include web application injection against a member-facing endpoint, exploitation of an internet-facing application or API, or abuse of compromised administrative credentials. None of these is confirmed.
Defenders should watch for updates from the PIPC review, which may publish technical findings that Chabi's initial disclosure omitted.
What Organizations Should Do
For Chabi members and users of Korean EV charging services:
- Change your Chabi password now, and change it anywhere you reused it. This is the highest-value action available. Chabi's assurance about encryption strength is unverifiable from outside, and password reuse converts a contained breach into a cascade across your other accounts.
- Treat all Chabi-branded communication as suspect through August. Reach the exposure-check tool by typing the company's domain directly rather than following links in email or SMS. Notifications begin July 27, which is precisely when phishing that mimics them will peak.
- Enable multi-factor authentication on any account that shared the compromised password, prioritizing email and financial services.
For charging operators and consumer-facing platforms:
- Audit your password storage implementation against current standards. If you cannot state your algorithm, salting scheme, and work factor from memory, you are not in a position to make the claim Chabi made. Migrate to a memory-hard function such as Argon2id or bcrypt with an appropriate cost factor, and rehash on next login.
- Instrument authentication endpoints for extraction-shaped behavior, not just failed logins. Bulk read patterns against member tables, anomalous query volumes from application service accounts, and unusual data egress from database tiers are the signals that catch this class of incident. Detection at the query layer beats detection at the perimeter.
- Minimize the plaintext fields you retain. Gender and date of birth were the unencrypted fields here. Ask whether each demographic attribute in your member schema earns its retention risk, and encrypt or drop the ones that do not.
- Pre-write your breach disclosure and rehearse the notification path. Chabi moved from incident to public disclosure and a customer lookup tool in three days, which is genuinely fast. That speed comes from preparation, not improvisation, and it is the part of this response most worth emulating.
Sources: Electric Vehicle Charging Company Chabi Reports Data Breach Affecting 300,000 Members | Aju Press