Gmarket, the South Korean online marketplace owned by Shinsegae Group, has confirmed that attackers got at customer personal data and mobile gift card PINs through a vulnerability in an external service's API. They then used some of those PINs to redeem customers' gift cards. The company reported the incident to the Korea Internet & Security Agency (KISA) on October 30. It filed with the Personal Information Protection Commission (PIPC) on the afternoon of November 1 and says it will refer the case to police soon. According to the Seoul Economic Daily, Gmarket has fully refunded customers who lost money and is paying 10,000 won in unrestricted Smile Cash to every customer whose data was exposed. Gmarket has not said how many customers were affected or how much the stolen gift cards were worth, and no regulator has published a figure.
What Happened
The first public signs came from customers, not the company. EBN reports that on October 29, posts appeared in online communities saying Culture Land gift cards stored in Gmarket accounts had been used without the owners knowing. One user said their card was redeemed between 6 and 7 a.m. on a morning they had not logged in. The Seoul Economic Daily reports that Gmarket's customer service centre had already received a run of similar complaints about department store and Culture Land gift cards that were marked as redeemed when customers tried to use them. EBN says early cases were in single digits but more reports kept coming in.
On October 30, Gmarket issued a statement, carried by the Seoul Economic Daily, Yonhap Infomax, Maeil Business (MK) and EBN. It said it had "confirmed indications that PIN numbers of mobile gift certificates purchased by some customers were registered and used by third parties without authorization." It said it had "blocked the unauthorized external access route and completed emergency security measures." It filed with KISA the same day. Yonhap Infomax reported that the filing was made because personal data might have leaked.
On October 30, the company had confirmed only unauthorized gift card use. EBN noted at the time that it was not yet clear whether personal data had left the company. By November 1, Gmarket was describing the incident as a personal data breach and had filed with the PIPC, which handles data protection cases. The Seoul Economic Daily reports that the company dated the first unauthorized access attempts to 2:11 p.m. on October 27. That is about three days before the KISA report. Gmarket described that report as made "immediately after detecting" the breach, but it has not explained the gap.
The timing is bad for the company. Big Smile Day, Gmarket's biggest yearly sale, starts November 2, and EBN notes the breach comes about two weeks after the company moved into its new Seongsu-dong headquarters.
What Was Taken
Reports about the data involved differ depending on when they were written:
- Headline reporting names customer names, user IDs and phone numbers.
- Gmarket's fuller list, as reported by the Seoul Economic Daily on November 1, adds e-coupon PINs, email addresses and home addresses.
- Passwords were not exposed, according to the company.
The gift card PINs did the most direct damage. A mobile gift card PIN works like cash: anyone who has it can register or spend it. That is why the theft turned into financial losses within days.
Volume: Gmarket has not said how many customers were affected, either directly or in any of the coverage. On October 30 it said it was still working out how far the incident reached. Neither KISA nor the PIPC has published a count.
Response: Losses were refunded in full in Smile Money, which can be used like cash. Every exposed customer also gets 10,000 won in Smile Cash whether or not they lost money. Gmarket is also replacing the PINs on all gift cards customers currently hold, in stages.
Why It Matters
Gift card wallets are cash. Many retail platforms store gift card PINs inside customer accounts, often with weaker protection than payment methods get. EBN reports that some users claimed the e-coupon box could be opened without any extra identity check. That claim has not been confirmed. If it is true, an attacker with read access to the PINs could turn them into money without ever touching a password.
Third-party APIs are the weak point. Gmarket blames a vulnerability in an external service's API, not its own login system. Gift card issuers, redemption processors and fulfilment partners often get wide read access to customer records, and their APIs are rarely checked as carefully as the main storefront.
Regulators are already watching. On October 29, a day before Gmarket's disclosure, MLex reported that the PIPC had named Gmarket, Coupang, SK Broadband and others in a review of call-centre privacy practices. That review found systems that let staff pull up full customer records with just a name or phone number, and that showed personal details without masking them. The two matters are separate, but the PIPC now has two recent reasons to look closely at how Gmarket controls access to customer data.
Flat payments to everyone are becoming the norm in Asia. In the same week, Japan's GMO Internet announced a flat 5,000 yen payment to all users of its breached Onamae.com Desktop Cloud service, separate from refunds for actual losses. The incidents are unrelated, but both companies paid everyone affected and reimbursed losses separately. Regulators and customers in the region may come to expect the same from others.
The Attack Technique
Here is what is publicly known:
- Way in: a vulnerability in an external service's API, according to Gmarket via the Seoul Economic Daily. The company has not named the service, the vulnerability type, or whether the flaw was in the third party's code or in how Gmarket connected to it.
- Start time: attempts began at 2:11 p.m. on October 27.
- Use of the stolen data: attackers registered or redeemed stolen gift card PINs, with community reports pointing to early-morning redemptions when account owners were unlikely to notice.
- Attacker: no group or individual has been named, and no one has claimed the attack.
The data mix (names, IDs, contact details, addresses and PINs together) suggests an API that returned full customer and order records, not just a gift card lookup. That would fit an authorization flaw, such as an endpoint that returns other users' records when the requested ID is changed. Gmarket has not confirmed this, and it is analysis, not a reported finding.
What Organizations Should Do
- Check what partner APIs can see. List every external service that can read customer or order data. Restrict each one to the fields it actually needs, and make sure no endpoint returns another user's records when the identifier in the request is changed.
- Protect stored gift card PINs like payment data. Encrypt them at rest, mask them in API responses, and require an extra check (one-time password or re-authentication) before a PIN is shown or transferred.
- Watch for unusual redemptions. Alert on bursts of gift card registrations or redemptions, redemptions from accounts with no recent login, and activity concentrated in off-peak hours.
- Treat customer complaints as security alerts. Here, customer reports came before the public disclosure. Send "my balance is already used" complaints to the security team, not just to refunds.
- Have a PIN replacement process ready. Be able to invalidate and reissue stored-value codes in bulk quickly, so stolen PINs become worthless while the investigation continues.
- Tighten security before big sales. Busy sale periods hide fraud in normal traffic. Increase API monitoring and rate limits before large promotions.
Sources: Gmarket Pays 10,000 Won to Customers Hit by Data Breach - Seoul Eco... | G Market Hit by Breach as E-Coupon PIN Numbers Leak - Seoul Economi... | G마켓 모바일 상품권 무단 사용 정황...KISA 신고·피해 보상 결정 < 채널 < 유통 < 기사본문 - 이비엔(EBN)... | Important Notice and Apology Regarding Unauthorized Access to “Onam... | Coupang, Gmarket among call centers reviewed in South ... | Gmarket Reports Unauthorized Use of Customer E-Coupons, Files Repor... | Gmarket تحقق في اختراق أرقام تعريف قسائم إلكترونية — نُقطة حِفظ | At Gmarket, it was confirmed that some customers' e-coupon pin numb...