ENKR

Daekyo macadamia member data breach

Add to my breach check

Made public · about 650,000 people

What leaked9

Replaceable

  • Password
  • Security questions and answers

Hard to replace

  • Mobile number
  • Home or delivery address
  • Email address
  • Username

Permanent

  • Connecting information
  • Date of birth
  • Full name
  • Passwordencrypted password; reached by the attacker, leak not established
  • Security questions and answerspassword check question and answer; reached by the attacker, leak not established
  • Home or delivery addressreached by the attacker, leak not established
  • Email addressreached by the attacker, leak not established
  • Usernameuser ID; Daekyo said the attacker reached it but it was unclear whether it left the company

To-dos8 · about 2 h in all

  1. Change the leaked password everywhere you reused itabout 30 minfreeStops: account takeover
  2. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  3. Turn on two-step sign-in for email and bankingabout 15 minfreeLimits harm from: account takeover, recovery takeover
  4. Register as an exposed person with the FSSabout 10 minLimits harm from: scam calls (opens in a new tab)
  5. Block new loans and cards in your nameabout 10 minLimits harm from: scam calls (opens in a new tab)
3 more
  1. This weekUse an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: account takeover
  2. This weekRemove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home
  3. When convenientReset security questions and remove password hintsabout 15 minfreeStops: recovery takeover

What happened next10 events

  1. Undetected 2 eventsabout 184 days · show events
  2. Response 5 eventsNo individual notice on record · show events
  3. RemedyNone on record
  4. Penalty 3 eventsFine ₩3.3B · Back to latest
  5. DisputesNone on record

Penalty: 3 events

Back to latest
  1. Ordered to strengthen safeguards on its personal data systems, overhaul its breach response, and publish the decision on its website
  2. Penalty surcharge of KRW 3.255 billion
  3. PIPC found Daekyo allowed needless direct access from an affiliate's web server to its member database and received a security alert during the first leak in August 2024 but neglected to analyse and block it, so the same attack worked again in February 2025; about 650,000 people affected
Company
Daekyo macadamia
When it happened
Company detected it
Made public
Notice
Leak confirmed
Affected
about 650,000 people · macadamia members; PIPC

How the facts developed

  1. Daekyo's notice of February 25, 2025 said the attacker reached member data through an affiliate's site and that it was unclear whether the data left the company. PIPC found that data of about 650,000 members leaked in two attacks, in August 2024 and February 2025

Sources