ENKR

Brightfix merchant data leak

Add to my breach check

Made public

What leaked6

Hard to replace

  • Bank account number
  • Mobile number
  • Home or delivery address
  • Employer
  • Other profile data

Permanent

  • Full name
  • Bank account numbersettlement account number, with bank name and account holder
  • Mobile numberrepresentative's mobile number
  • Home or delivery addressrepresentative's address and business address
  • Employertrade name of the business
  • Full namemerchant representative's name
  • Other profile databusiness main phone number

To-dos4 · about 45 min in all

  1. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  2. Register as an exposed person with the FSSabout 10 minLimits harm from: scam calls (opens in a new tab)
  3. Block new loans and cards in your nameabout 10 minLimits harm from: scam calls (opens in a new tab)
  4. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home

What happened next8 events

  1. Undetected 2 events0 days · show events
  2. Response 5 eventsNo individual notice on record · show events
  3. RemedyNone on record
  4. Penalty 1 eventOngoing · show events
  5. DisputesNone on record
  1. Damage claims taken by phone; each claim reviewed and the claimant told whether and how compensation applies
  2. Apology in the notice
  3. Notice of the merchant data leak posted on the company website
  4. FSC named the payment company among 16 financial firms with breaches confirmed before and after the Shinhan Bank attack
  5. Leak found at about 18:10
3 more
  1. Intrusion began
  2. SMS two-factor login for administrators, tighter access rights and authentication, and known flaws fixed
  3. Attacker IP blocked and the administrator account password changed
Company
Brightfix
When it happened
Company detected it
Made public
Notice
Leak confirmed
Affected
unknown; merchants and their representatives · company notice

How the facts developed

  1. Company notice: an administrator account was taken over in an outside attack at about 15:59 on October 10, 2026; merchant data was viewed and some of it downloaded

Sources