REAS: intrusion into the Chatpia live chat admin server leaks data of 216,829 people

REAS Inc. said on 10 November that the admin server of its live chat service Chatpia had been accessed without authorization from the night of 1 November to midday on 2 November, and that member and performer data stored in its database had leaked. It detected the access at about 11:30 on 2 November and blocked it the same day. [1]

The leak covers 216,829 people. For 205,129 members it includes email addresses (87,960), login passwords (1,681), real names (4,040), home addresses (3,182), phone numbers (7,960), card holder names (140,970), inquiry contents (20,504) and member codes. For 11,700 performers it includes email addresses (11,109), handle names, performer codes and inquiry contents. [1]

Card holder names and phone numbers had been kept to stop members from claiming free points twice; card numbers, expiry dates and security codes are not stored. The names and addresses belong to members who applied for delivery events (letters, Valentine's, summer and year-end gifts) from February 2013 to September 2026. ID images are deleted after registration and did not leak. No alteration or deletion of data and no misuse has been found. [1]

REAS found and blocked the point of entry and is strengthening its security. It reported the incident to the Personal Information Protection Commission. It plans to force a password change for members whose passwords leaked and advises all other users to change theirs. It will no longer keep card holder names or phone numbers. [1]

Change the password on any other service that uses the same one, and do not open links or attachments in suspicious email. [1]