SODA: the database of the marketplace app "SNKRDUNK" was accessed without authorization and data of 2.75 million may have leaked

1. 2022-06-07

   It found unauthorized access to the database. Investigation showed that personal data of some members might have leaked. It promptly secured the affected part and reported to the Personal Information Protection Commission and consulted the police. [1] [2]

2. 2022-06-10

   It completed the first response. [1]

3. 2022-06-15

   It announced the case and notified affected members by email. [1] [2]

4. 2022-08-23

   It added to the same notice the measures that strengthen security: regular vulnerability assessments, monitoring and static analysis. No misuse of personal data has been confirmed. [1]

Up to 2,753,400 records may have leaked: name, birth date, email address, address, phone number, purchase information, bank account information and passwords in a one-way hashed form, with bank account information in 10 cases. About 60% of members had only birth date, email address and password exposed. Credit card numbers and ID documents are not included. The cause was a flaw that returned responses containing database content to malicious requests. The English-language site was not affected. [1]