ENKR

GS Retail credential-stuffing breach

Add to my breach check

Made public · 1,660,153 people

What leaked7

Hard to replace

  • Mobile number
  • Home or delivery address
  • Email address
  • Username

Permanent

  • Date of birth
  • Full name
  • Gender

To-dos4 · about 45 min in all

  1. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  2. Register as an exposed person with the FSSabout 10 minLimits harm from: scam calls (opens in a new tab)
  3. Block new loans and cards in your nameabout 10 minLimits harm from: scam calls (opens in a new tab)
  4. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home

What happened next13 events

  1. Undetected 2 events197 days · show events
  2. Response 7 eventsNotice in 54 days · show events
  3. RemedyNone on record
  4. Penalty 4 eventsFine ₩12.8B · Back to latest
  5. DisputesNone on record

Penalty: 4 events

Back to latest
  1. Ordered measures against recurrence · abnormal-access detection, a review of privacy governance including dedicated staff and the CPO's authority, and publication on its website
  2. Administrative fine of KRW 3 million
  3. Penalty surcharge of KRW 12.8 billion
  4. PIPC found no detection or blocking of mass logins, weak privacy governance, and late notice to 1,599 people identified later
Company
GS Retail
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
1,660,153 people · 1,581,025 GS SHOP + 79,128 GS25; PIPC

How the facts developed

  1. Announced on January 6, 2025: about 90,000 customers affected (press). PIPC later found 1,581,025 GS SHOP and 79,128 GS25 members affected; 1,599 more people identified during its investigation were notified more than 72 hours after the leak was known

Sources