ENKR

Hitai massage booking app data breach

Add to my breach check

Made public · 163,743 people

What leaked3

Hard to replace

  • Mobile number
  • Other profile data

Permanent

  • Purchase or order history
  • Purchase or order historybookings (partner shop name, amount, booking status) and payment records · order time, transaction ID, cancel key; card numbers were masked and not leaked
  • Other profile datanickname

To-dos1 · about 5 min in all

  1. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: phishing messages

What happened next11 events

  1. Undetected 3 events4 days · show events
  2. Response 7 eventsNo individual notice on record · show events
  3. Remedy 1 eventUntil April 23, 2027 · show events
  4. PenaltyNone on record
  5. DisputesNone on record
  1. Four KRW 5,000 Hitai discount coupons (KRW 20,000) for each affected mobile number, members or not; no cash; claim by 23 April 2027, use by 31 May 2027Until April 23, 2027
  2. The CEO apologised in the leak notice
  3. Leak notice posted on the Hitai website and app: 163,743 people, nickname, mobile number, bookings and payment records
  4. AppTube found the leak at about 17:00 KST, four days after the attack
  5. Intrusion began
6 more
  1. AppTube said scammers were using the leak to demand money, posing as staff of a partner shop and claiming to hold photos or videos
  2. A security firm's cause analysis was sent to KISA, which was cross-checking it
  3. Asked the police to investigate; the case moved from Guro police station to the Seoul Metropolitan Police Agency
  4. Affected people told one by one by text message
  5. Reported the leak to KISA and to PIPC
  6. Blocked the abnormal access path and the linked function, and checked the systems and APIs
Company
Hitai massage booking app
When it happened
Company detected it
Made public
Notice
Leak confirmed
Affected
163,743 people · counted by unique mobile number; company notice

How the facts developed

  1. Company notices: an attacker used a flaw in an API kept for old app versions on September 3, 2026 and read booking data of 163,743 people; AppTube found it on September 7, 2026, reported to PIPC and KISA, asked the police to investigate, and on October 23, 2026 offered discount coupons

Sources