ENKR

Hitai massage booking app data breach

Add to my breach check

Made public · 163,743 people

What leaked3

Hard to replace

  • Mobile number
  • Other profile data

Permanent

  • Purchase or order history
  • Purchase or order historybookings (partner shop name, amount, booking status) and payment records · order time, transaction ID, cancel key; card numbers were masked and not leaked
  • Other profile datanickname

To-dos1 · about 5 min in all

  1. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: phishing messages

What happened next11 events

  1. Undetected 3 events4 days · Back to latest
  2. Response 7 eventsNo individual notice on record · show events
  3. Remedy 1 eventUntil April 23, 2027 · show events
  4. PenaltyNone on record
  5. DisputesNone on record

Undetected: 3 events

Back to latest
  1. AppTube found the leak at about 17:00 KST, four days after the attack
  2. Intrusion began
  3. AppTube said scammers were using the leak to demand money, posing as staff of a partner shop and claiming to hold photos or videos
Company
Hitai massage booking app
When it happened
Company detected it
Made public
Notice
Leak confirmed
Affected
163,743 people · counted by unique mobile number; company notice

How the facts developed

  1. Company notices: an attacker used a flaw in an API kept for old app versions on September 3, 2026 and read booking data of 163,743 people; AppTube found it on September 7, 2026, reported to PIPC and KISA, asked the police to investigate, and on October 23, 2026 offered discount coupons

Sources