Twenty-three users of Seoul's city-run Ttareungyi public bike-share have filed a damages suit against the Seoul Facilities Corporation (SFC) over a confirmed 2024 breach that the operator now says exposed the personal data of roughly 4.62 million members. The complaint, filed by the digital information committee of Lawyers for a Democratic Society (Minbyun) at the Seoul Central District Court on Saturday, August 22, seeks 300,000 won (about $217) per plaintiff and alleges two separate failures: inadequate technical safeguards under Article 29 of Korea's Personal Information Protection Act (PIPA), and concealment of the incident for nearly two years in breach of the Article 34 notification duty. SFC has not disputed the scale of the exposure; it began individual notification on July 21, 2026, and offered every affected rider a 30-day transit pass worth 5,000 won (roughly $3.40).
A sourcing note: every account available for this brief is press reporting rather than a primary victim filing, regulator publication, or CERT advisory. SFC's own statements reach us only as quoted in those reports, and the details below are attributed accordingly.
What Happened
The intrusion itself is dated to late June 2024. Digital Today reports that the Korea National Police Agency's Cyber Investigation Division confirmed an external attack exploiting security vulnerabilities in the Ttareungyi system running for two days from June 28, 2024; the Korea Herald puts the same window at June 28 to 29, 2024, attributed to SFC. That is the most consistent element across the reporting.
The timeline after that is where the case gets uncomfortable. According to the Korea Herald, police notified SFC of the breach on January 27, 2026, roughly nineteen months after the attack, and only in the course of investigating the suspects. The Korea JoongAng Daily similarly reports the breach "came to light in January" during a police investigation. SFC then spent close to six more months working with the National Police Agency and the Personal Information Protection Commission (PIPC) to determine exactly which fields had been taken per individual before it began texting victims on July 21, 2026, at a rate of about 1.2 million messages per day. Minbyun's core allegation is that the corporation sat on indications of the breach for close to two years rather than notifying regulators and users on the statutory clock.
Accounts of who carried out the attack differ. The Korea JoongAng Daily, citing police, describes two high school students; the Korea Herald says police identified two middle school students as suspects; the JoongAng's earlier July report simply says "two teenagers." What is consistent is that two minors were identified and, per the JoongAng, referred to prosecutors in February 2026.
The stated cause also conflicts. Seoul Shinmun notes that the city had earlier announced the Ttareungyi app was hit by a distributed denial-of-service (DDoS) attack in June 2024 that resulted in the leak of member data. Every other account, including the police characterization relayed by Digital Today and SFC's own remediation language, describes exploitation of a web application vulnerability rather than a volumetric attack. The likeliest reading is that an early public statement mislabeled the incident, but on the sources available the accounts do not reconcile cleanly, and readers should treat the DDoS framing as an outlier claim.
What Was Taken
The victim count is reported at 4.62 million by SFC and carried by Digital Today, the Korea Herald, Seoul Economic Daily, Kyunghyang Shinmun, Chosun and Seoul Shinmun. Two outlets round down in their framing: Digital Today's headline and the Korea JoongAng Daily's July piece both describe "more than 4 million" and "around 4 million" victims respectively, while their body text cites the same 4.62 million figure. Treat 4.62 million as the operative number, with "4 million plus" as loose rounding rather than a competing count.
The exposed fields, consistent across Seoul Economic Daily, Kyunghyang, Chosun and Seoul Shinmun, include: user ID, mobile phone number, date of birth, gender, body weight, email address, postal code, and home address. For members registered as minors, a guardian's mobile phone number, date of birth and gender were also exposed. SFC stresses that the actual fields taken vary per member depending on when and through which channel they registered.
Two aspects raise the sensitivity above a routine credential-adjacent leak. First, the combination of full home address, date of birth, gender and mobile number is a near complete identity kit for SIM-swap, account-recovery abuse and targeted smishing against a population that is geographically pinned to Seoul. Second, the presence of guardian contact details means the dataset includes information on children and a link between child and guardian, a category that draws heightened scrutiny under PIPA and that has obvious value for social engineering.
SFC has stated, per the Korea Herald and Kyunghyang, that from the June 2024 leak through the present it has identified no confirmed cases of secondary damage. That is a claim about detection, not a guarantee, and it covers a period during which the operator was unaware the breach had occurred at all.
Why It Matters
This is a municipal service breach, not an enterprise one, and that is precisely the point. Ttareungyi is a low-cost civic amenity launched in 2015 that most riders would not consider a data-sensitive relationship. The registration flow nonetheless collected home addresses, birth dates, body weight and guardian contacts, and retained them at a scale of 4.62 million records. Data minimization failures of this shape are endemic to public-sector consumer apps, where the collection is designed around service convenience and no one revisits the retained field list against breach risk.
The detection failure is the sharper lesson. On the reported timeline, the operator learned of the incident from law enforcement roughly nineteen months after the fact, which implies that neither the exploitation nor the bulk extraction of millions of records generated an alert anyone acted on. SFC's own remediation description, quoted by Chosun, is that it "addressed web vulnerabilities and strengthened monitoring for abnormal behavior," an implicit acknowledgment that the abnormal-behavior monitoring was not there before.
Finally, the compensation response has become its own reputational incident. The uniform 5,000 won pass drew immediate public anger, with one affected user telling the Korea Herald it made her feel "as though my personal information was worth only 5,000 won." Chairperson Han Kook-young apologized publicly and pledged to restore trust. The gap between a 5,000 won coupon and the 300,000 won per person the plaintiffs are demanding, a 60x spread, is the practical measure of how badly a token remedy can misjudge the room. Minbyun has said it may file additional suits if more victims come forward, so the exposure is open-ended.
The Attack Technique
The technical detail is thin but pointed. Police describe exploitation of security vulnerabilities in the Ttareungyi system over a two-day window. Minbyun's complaint is more specific and is the most useful indicator available: it alleges the corporation left the system configured so that personal information could be accessed without an authentication token.
If that allegation is accurate, this was a broken object-level authorization or missing-authentication flaw in the app's backend API, the single most common serious defect in mobile-app-backed consumer services. Such endpoints are trivially enumerable once found, which explains how two minors with no apparent sophisticated tooling could extract millions of records in under 48 hours. It also explains the detection failure: to a naive log pipeline, high-volume authorized-looking API reads are indistinguishable from normal app traffic. This is an allegation in a live civil complaint, not an adjudicated finding, but it is consistent with both the police vulnerability characterization and SFC's remediation of "web vulnerabilities."
What Organizations Should Do
-
Audit every API endpoint for authentication and object-level authorization. Specifically test whether member records can be retrieved by iterating an ID without a valid session token, and whether a valid token for user A can retrieve user B's record. Automated scanners routinely miss the second case; it requires deliberate test cases.
-
Instrument bulk-read detection on personal data stores. Set volumetric alerting on records-returned-per-session and per-source-IP, not just on failed logins and error rates. The single highest-value control here would have flagged millions of member reads inside a two-day window.
-
Re-audit collected fields against actual service need. A bike rental does not require body weight, home address and guardian contact details to be retained indefinitely for 4.62 million accounts. Delete or tokenize what the service does not use operationally, and cap retention for dormant accounts.
-
Pre-build the breach notification workflow before you need it. Six months elapsed between police notice and user notification, largely spent reconstructing per-user exposure. Field-level logging of what each account holds, and a pre-agreed regulator consultation path, compress that to weeks.
-
Treat law-enforcement notification as a detection failure to be investigated, not just an incident to be managed. If police tell you first, run a root-cause review of why your own telemetry did not, and publish the answer internally with a remediation owner.
-
Scope remediation to the harmed population, not the accounting budget. Where identity-grade data including addresses, birth dates and minors' guardian details is exposed, credit and identity monitoring plus a documented remediation plan is the defensible floor. A service coupon worth less than a coffee invites both the litigation and the news cycle now facing SFC.
Sources: Seoul Ttareungyi bike users sue over data breach affecting 4.62 mil... | Seoul bike-share Ttareungi data leak victims to receive 30-day pass... | Seoul's 5,000 won compensation fuels anger after bike-sharing servi... | Seoul Notifies 4.62 Million of Ttareungyi Data Breach, Offers Free... | Personal data of 4.62 million members ‘cleaned out’···“Ttareungi 30... | Seoul Facilities Corporation Offers 30-Day Passes to Ttareungi Leak... | Seoul Ttareungi data breach: 4 million users to get free 30-day bik... | ‘따릉이’ 정보유출 시민에 30일권 보상