NEL: unauthorized access to its osina platform leaks personal data of 235,329 people

On 29 October NEL said an attacker exploited a vulnerability in a data analysis tool it used and personal data left its systems. It found the intrusion on 14 October and gave the Personal Information Protection Commission a preliminary report on 17 October covering 235,329 people. For osina members the data are names, addresses, phone numbers, birth dates, bank account details (including account holder names), reward amounts, authentication data for SNS linking, and LINE or Apple login IDs with usage history. Business contacts are affected with names, email addresses and hashed passwords, people who made enquiries with names, contact details, company and message, and prospective creators with activity names, age, gender, residence and SNS URLs. NEL holds no member email addresses, passwords or card data, so those are not affected. As of 29 October no new unauthorized access or secondary harm was found. Affected people were told on the same day through in-app notices and email.