NHN Dooray, the operator of the cloud collaboration platform Dooray!, has confirmed that an outside party broke into some client accounts and took business data and employee personal information. The company said so in a notice on its website on November 14. According to E-Daily and Zerowiz Magazine, the attacker got in two ways. One was by entering password-reset verification codes over and over until one worked. The other was by using API keys exposed through a flaw in Dooray's open API. NHN Dooray has reported the incident to the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission. It has not said how many client companies or individuals were affected, and its investigation into the full scope is still going.
What Happened
Dooray's notice, as reported by E-Daily and Zerowiz Magazine, says the intrusion ran from about 10:00 p.m. on November 12 into the early hours of November 13.
The public picture built up over two days:
- November 13: Boannews broke the story. It reported that NHN Dooray had found "external account access attempts" early that morning. The company deleted every existing service API key and admin API key, and API access was switched off for both private and public sector clients. A company official told Boannews the shutdown was decided "from the most conservative standpoint." The official also said a dedicated response team had been set up, and that the scope, cause and any personal data leak were still being worked out. Zerowiz, citing IT Chosun and Global Economic, reported that mail and calendar kept running and that only API services were restricted. No date was given for bringing the API back.
- November 14: NHN Dooray published a fuller notice. It confirmed that the access attempts had become actual breaches and that data had been taken. According to Zerowiz, the company filed a breach report with KISA on November 13 and a personal data leak report with the Personal Information Protection Commission on November 14. E-Daily reports that affected client companies and individual account holders have been notified.
At first, outlets described the event only as suspicious access attempts and an API shutdown. The November 14 notice is the first statement from the company that confirms data was stolen.
What Was Taken
According to the notice as reported by E-Daily and Zerowiz, the stolen data falls into two groups:
- Client business content: work material stored in the Projects, Drive, Messenger and Calendar features of some client accounts. E-Daily quotes NHN Dooray as saying that "some client companies' mail and messenger" content was confirmed as leaked.
- Client employee account details: user ID, name, external email address, phone number, department, rank, job title and company name.
Zerowiz reports that the notice also separately lists personal data held in NHN Dooray's own corporate work files: name, email, mobile and phone numbers, position, department and company name. The company calls these fields that "may have been leaked." It says each person's actual exposed fields are given in their individual notification email. In other words, the full list does not apply to every victim.
Volume: No figure has been published, either for affected client companies or for individual records. Zerowiz notes that NHN Dooray has not said whether any public sector clients were among those affected. Victim counts in breaches like this often come out late and change over time, so readers should treat any number that appears soon after as provisional.
Why It Matters
Dooray! is used by private companies, government ministries and public institutions. E-Daily notes it was recently used to build "Gukbang I-eum," a defence collaboration platform for about 300,000 military personnel. Nothing reported so far says that platform was affected. Still, the customer base shows how sensitive the data in Dooray tenants can be.
The incident also fits a pattern. South Korean business software providers have been hit repeatedly in recent weeks:
- MK reports that Daou Technology's groupware product, Daou Office, was abused in a breach at Bithumb. That breach exposed data on 844 customers and 715 executives and staff. A breach at Hanyang Securities through the same product followed, with 31 leaked records confirmed, three of them including resident registration numbers. MK notes it was not confirmed whether the two attacks used the same route.
- IAX's November 14 briefing reports that the Douzone Bizon incident may have spread to another 13 organisations.
When one shared platform is breached, every customer of that platform may become a victim. The data stolen here is also well suited to follow-up attacks. Names, titles, departments, phone numbers and internal messages give attackers what they need for convincing phishing and SMS phishing (smishing) aimed at the affected companies. NHN Dooray itself warned users about this.
The Attack Technique
NHN Dooray has described two separate routes. It has not published technical details beyond that.
- Brute-forcing the password reset code. During the "find password" flow, the attacker kept entering verification codes until one was accepted. They then changed the account password and logged in. Zerowiz points out that this only works if there are weak or missing limits on how many attempts are allowed. Short numeric codes can be guessed quickly by an automated tool. Zerowiz is clear that this is its own reasoning from the notice. Dooray has not disclosed the code length or the attempt limit.
- Open API flaw exposing keys. A security flaw in Dooray's open API service leaked "some" authentication keys. Unauthorised outside API calls using those keys were confirmed. The company has not said what kind of flaw it was or how many keys were exposed. A security industry source quoted by Boannews said that shutting down the whole API usually means either a flaw in the API itself or keys leaked in bulk or tied to particular customers.
NHN Dooray says it has blocked the attacking IP addresses, strengthened the verification step in password recovery, deleted all service and admin API keys, and reset passwords on accounts confirmed as compromised. No threat actor has been named, and no group has claimed responsibility.
What Organizations Should Do
- If you use Dooray, assume your API integrations are broken and your old keys are compromised. Once the API is restored, issue new keys and scope each one to the least access it needs. Record which bots, scripts and external systems depend on them.
- Review account recovery and login logs for password resets and logins between November 12 and 13, especially from unfamiliar IP addresses or at odd hours. Force a password reset on any account that looks suspicious.
- Turn on two-step verification for every user, as NHN Dooray recommends. Check that the password reset flow can't be used to get around it.
- Warn staff about targeted phishing and smishing. Leaked names, titles, phone numbers and internal messages make impersonation of colleagues and executives believable. Require a callback on a known number before acting on any request for payment or credentials.
- Test your own reset and one-time-code flows. Limit attempts per account and per IP address, lock accounts after repeated failures, expire codes quickly, and send alerts when codes fail many times in a row.
- List every collaboration and groupware platform your organisation uses. Check your notification and reporting duties under Korea's Personal Information Protection Act in case your data is in an affected tenant.
Sources: NHN Durey Security Breach… Leak of Client Business Data - EDAILY | NHN두레이, 고객사 업무자료/임직원 정보 유출 확인 제로위즈 매거진 | 11월 14일 보안 브리핑: 협업 도구 두레이도 침해 정황 — IAX 보안 뉴스룸 | Amid a recent series of hacking incidents in the financial sector,... | How 8-K filings count people affected by a breach cisonews.net | NHN두레이 해킹 시도에 API 키 전량 폐기... 민간/공공 연동 중단 제로위즈 매거진 | NHNドゥレイでセキュリティ事故…顧客企業の業務資料が流出 - EDAILY | 단독 협업 도구 ‘두레이’ 해킹... API 서비스 차단 < 긴급경보 < 사건·사고 < 기사본문 - 보안뉴스