Spoon Inc., the operator of Lotte Group-affiliated mobile coupon service Giftiel, has confirmed that an attacker gained unauthorized external access to its systems and exposed customers' personal data, including bank account numbers they had entered to get coupon refunds. Spoon is a wholly owned subsidiary of Daehong Communications, Lotte Group's advertising affiliate. All eight sources for this brief are press reports that cite Spoon's website notice and statements. We have not seen a regulator filing or national CERT advisory. Only one outlet (Chosun Biz) gives a figure for the number of people affected: 18,359. Several other reports published the same day said the scale was still being assessed. Chosun Biz also reports that the company has found no monetary damage from fraudulent coupon use so far. The investigation is ongoing.
What Happened
According to Chosun Biz, Spoon detected signs of abnormal activity from unauthorized external access at 7:16 p.m. KST on October 22. It suspended the service right away, blocked the attacking IP addresses and tightened system access controls. After fixing vulnerabilities and running security checks, it brought the service back at 5:20 p.m. on October 23.
Sources disagree on when the breach was made public. Seoul Economic Daily and BigGo say Spoon posted its website notice on October 22. Financial News and Financial Post say the announcement came on October 25. Most outlets agree that Spoon confirmed the breach on the 22nd. One possible explanation is that the notice was posted or updated on the 25th, but no source confirms this.
Chosun Biz reports that Spoon notified the Personal Information Protection Commission (PIPC), the Korea Internet & Security Agency (KISA) and the Financial Supervisory Service at 4:30 p.m. on October 23, and asked law enforcement to investigate. Other outlets describe these as reports to "specialized security agencies and relevant government departments." The Asia Business Daily and SBS say a joint investigation with the authorities is under way.
Sources also differ on notification status. Chosun Biz says individual MMS notifications began at 7:22 p.m. on October 23 and were continuing. Financial Post (October 26) says all affected individuals have now been notified. Spoon has also set up a channel for customers to report harm.
Giftiel issues and handles refunds for mobile exchange vouchers for Lotte dining brands such as Lotteria and Angel-in-us. Chosun Biz notes that it is a separate service from the Lotte Mobile Gift Certificate run by Lotte Members.
What Was Taken
Every source lists the same four exposed fields:
- Name
- Mobile phone number
- Email address
- Refund bank account number
Scope: Chosun Biz and BigGo report that the exposure does not cover all Giftiel users. It is limited to customers who typed in their bank account details when they asked for a coupon refund.
Volume: Chosun Biz's later report puts the number of affected people at 18,359. Its own earlier article, along with Seoul Economic Daily, BigGo and others, said the figure was still being tallied. Spoon's notice, as quoted in the coverage, does not give a number. Treat 18,359 as the best available figure until a regulator or the company publishes one.
Financial impact: Chosun Biz reports that no monetary damage from fraudulent coupon use has been confirmed. No source reports that card data, passwords or national ID numbers were exposed.
Why It Matters
The record count is small, but the data is risky because of how the fields combine. A name, phone number, email address and a real bank account number linked to a known Lotte brand transaction give fraudsters everything they need for convincing smishing and voice phishing. A scammer can quote the victim's actual account number and pose as Giftiel, Lotte, a bank or the FSS. Korea already has a well-established voice-phishing industry, so this kind of data is valuable to criminals.
The breach also points to a common design problem. Refund workflows often collect financial data that the main service doesn't need, and then keep it long after the refund has been paid. Customers who used Giftiel only to redeem vouchers appear not to be affected. The people who are exposed are the ones who handed over bank details for a one-time refund. Defenders should look at where similar "side-channel" stores of financial data sit in their own environments, especially at subsidiaries and marketing-run services that may get less security attention than the parent company's core systems.
The Attack Technique
No source names the initial access vector, a vulnerability, malware or a threat actor, and nobody has claimed responsibility. What the reports do show:
- The intrusion came from external IP addresses, which Spoon blocked.
- Chosun Biz says Spoon "fixed vulnerabilities" before bringing the service back, which suggests an exploitable flaw rather than only stolen credentials. The specific weakness has not been disclosed.
- Spoon is "strengthening database access monitoring" (Seoul Economic Daily, Asia Business Daily, SBS, Financial Post). This suggests the attacker reached the database holding refund records directly, and that DB-level monitoring was not strong enough to stop it.
Detection on the evening of October 22 and restoration about 22 hours later point to a fast containment response. How long the attacker had access before detection has not been reported.
What Organizations Should Do
- Find and minimize refund and payout data. List every place where customer bank account numbers are collected for refunds. Delete or tokenize them once the refund is paid, and keep them separate from general customer databases.
- Monitor database access, not just perimeter traffic. Alert on bulk reads, unusual query patterns and access from application accounts outside their normal behavior on tables that hold financial identifiers.
- Audit subsidiary and affiliate platforms. Coupon, marketing and gift-card services run by agency subsidiaries often fall outside group-level security programs. Bring them under the same vulnerability management and penetration testing schedule.
- Prepare anti-phishing communications ahead of time. When contact details and financial data leak together, tell customers the exact channels you will and won't use to contact them. Point Korean customers to the Integrated Account Information Service (Account Info) and the FSS identity theft prevention service, as Spoon did.
- Watch for spoofed brand campaigns. Monitor for lookalike domains and SMS sender IDs imitating Giftiel, Lotteria, Angel-in-us and Lotte, and coordinate takedowns with KISA.
- Rehearse fast regulatory notification. Spoon reported to PIPC, KISA and the FSS within about 21 hours of detection. Check that your own playbooks can meet PIPA's notification deadlines.
Sources: Lotte Giftiel hack leaks data of 18,359 customers in South Korea -... | Lotte Affiliate Giftiel Reports Customer Data Leak From Hacking - S... | Lotte Giftiel hack leaks refund applicants’ data in South Korea - C... | Hacking at Lotte Group-Affiliated Coupon Issuer Giftiel Leaks ... | Customer Information Leaked in Hack of Lotte's 'Gipeutiel' - The As... | Lotte Affiliate Giftiel Suffers Customer Data Leak Due to Hacking | Personal data leaked in hack attack on Lotte coupon issuer Giftiel... | '보안 뚫린' 롯데 기프티엘, 경찰 수사 의뢰하고 DB 감시 강화했지만… < 재계·전자 < 산업 < 기사본문 - 파이낸셜포스트