Loading story…
South Korean police charged two teenagers (identified as Persons A and B) for allegedly breaching Seoul’s public bike hire service Ttareungyi and exfiltrating user data. Authorities say the intrusion occurred in June 2024 and resulted in the exposure of data on 4.62 million individuals—about 90% of the service’s roughly 5 million registered users—making it one of the larger recent consumer data thefts disclosed in South Korea.
According to the Seoul Metropolitan Police Agency’s Cyber Investigation Unit, Person A allegedly performed the access that enabled the theft, while Person B allegedly encouraged downloading the dataset; the two reportedly met on Telegram and bonded over an interest in information security. The stolen data reportedly included user IDs, phone numbers, home addresses, email addresses, dates of birth, genders, and weights; the teens were arrested on suspicion of violating South Korea’s Information and Communications Network Act and referred to prosecutors, with detention requests reportedly denied due to their age.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
On or before February 24, 2026, the Seoul Metropolitan Police Agency said the two teenagers were charged and referred to prosecutors for allegedly breaching Ttareungyi. Police said there was no evidence the stolen data had been leaked or sold, and prosecutors reportedly rejected arrest warrant requests because the suspects were juveniles.
After the private mobility company filed a complaint, police investigated the earlier DDoS case, seized devices, and conducted forensic analysis. Investigators said they found files containing Ttareungyi user data, which connected the two teens to the bike service breach.
Between June 28 and 29, 2024, the two teens allegedly accessed a Ttareungyi server operated by the Seoul Facilities Corporation and exfiltrated a database affecting 4.62 million users. The stolen data reportedly included user IDs, contact details, home addresses, and demographic information.
In April 2024, one of the South Korean teen suspects allegedly sent about 470,000 mass signals to overwhelm a private mobility rental company's servers. During that activity, investigators say he identified vulnerabilities in Seoul's Ttareungyi bike service system and shared them with the other suspect.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcedatabreaches.net
Open sourcehelpnetsecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
South Korea’s Personal Information Protection Commission imposed a record **624.6 billion won** fine on Coupang, plus **248 million won** on subsidiary Coupang Fulfillment Service, after a breach exposed personal data tied to roughly **34 million to 37.55 million people**. Regulators said the incident stemmed from weak security controls, including poor authentication key management and inadequate access restrictions, and that exposed data included names, email addresses, shipping addresses, phone numbers, and order histories. Authorities said the breach began in 2025 and persisted for months before discovery, making it one of the country’s largest retail-sector privacy incidents. The commission also cited Coupang for failures involving data destruction, breach notification, interference with the independence of its data protection officer, and obstruction of the investigation. Investigators identified the main suspect as a former Coupang IT employee, described in one report as a **43-year-old Chinese national**, who allegedly retained sensitive data on multiple hard drives and tried to destroy evidence by discarding a laptop in a river. Coupang said it plans to challenge the penalty, disputed aspects of the exposure, and maintained the stolen data was limited, deleted from recovered devices, and not shared onward.
Jun 29, 2026
South Korean authorities attributed Coupang’s large-scale customer data leak to **management and security control failures**, not a sophisticated external cyberattack. Investigators said a **former Coupang engineer** who knew about weaknesses in the company’s authentication process gained unauthorized access beginning in April (after an earlier attempt in January) and maintained access until November, exploiting authentication vulnerabilities to access user accounts without proper login. Officials urged Coupang to remediate security weaknesses and asked police to investigate allegations that Coupang deleted some data despite an order to preserve it; Coupang said it is strengthening safeguards and claimed there was no evidence other parties accessed or viewed the data, and that the exposed data did not include payment or login information. The incident affected roughly **33.7–34 million** customers, with exposed data reported to include **names, email addresses, phone numbers, shipping addresses, and some order history**. The breach has escalated into a cross-border legal and political dispute: multiple **U.S. investment firms** (including Greenoaks, Altimeter, Abrams Capital, Durable Capital Partners, and Foxhaven Asset Management) filed notices seeking **investor–state dispute settlement (ISDS)** arbitration under the **Korea–U.S. Free Trade Agreement**, alleging South Korea’s investigation and enforcement actions were discriminatory and unusually severe compared with other domestic breach cases; reported measures included threats of major fines, operational suspension, and executive travel bans.
Jun 29, 2026
Woowa Brothers, operator of South Korea’s food delivery platform Baedal Minjok (**Baemin**), disclosed a customer data leak after a criminal ring infiltrated an outsourced firm that managed its customer service center. Police and the company said a suspect posed as a new rider recruit, gained access to a customer’s personal information including a contact number and address, and allegedly obtained the data for a retaliation-for-hire request coordinated through Telegram. Police said the suspects were apprehended shortly after authorities informed Woowa Brothers of the breach. The company reported the incident to the Personal Information Protection Commission, notified customers believed to be affected, and said it will terminate its partnership with the service provider while tightening internal controls over personal data handling. The case adds Baemin to a growing list of South Korean companies hit by customer data leaks, alongside recent incidents involving Coupang, SK Telecom, and Lotte Card.
Jun 29, 2026