ENKR

Hitai massage booking app data breach

Add to my breach check

Made public · 163,743 people

What leaked3

Hard to replace

  • Mobile number
  • Other profile data

Permanent

  • Purchase or order history
  • Purchase or order historybookings (partner shop name, amount, booking status) and payment records · order time, transaction ID, cancel key; card numbers were masked and not leaked
  • Other profile datanickname

To-dos1 · about 5 min in all

  1. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: phishing messages

What happened next11 events

  1. Undetected 3 events4 days · show events
  2. Response 7 eventsNo individual notice on record · show events
  3. Remedy 1 eventUntil April 23, 2027 · Back to latest
  4. PenaltyNone on record
  5. DisputesNone on record

Remedy: 1 event

Back to latest
  1. Four KRW 5,000 Hitai discount coupons (KRW 20,000) for each affected mobile number, members or not; no cash; claim by 23 April 2027, use by 31 May 2027Until April 23, 2027
Company
Hitai massage booking app
When it happened
Company detected it
Made public
Notice
Leak confirmed
Affected
163,743 people · counted by unique mobile number; company notice

How the facts developed

  1. Company notices: an attacker used a flaw in an API kept for old app versions on September 3, 2026 and read booking data of 163,743 people; AppTube found it on September 7, 2026, reported to PIPC and KISA, asked the police to investigate, and on October 23, 2026 offered discount coupons

Sources