ENKR

Ttareungyi (Seoul public bike) member data breach

Add to my breach check

Made public · about 4.62 million people, Ttareungyi members

What leaked7

Hard to replace

  • Mobile number
  • Home or delivery address
  • Email address
  • Other profile data
  • Username

Permanent

  • Date of birth
  • Gender
  • Home or delivery addresspostcode and address
  • Other profile databody weight; guardian's mobile number, birth date and gender

To-dos

None of the harms this check covers.

Company
Ttareungyi
When it happened
–
Company detected it
Made public
Notice
Leak confirmed
Affected
about 4.62 million people, Ttareungyi members; the operator knew of the leak in July 2024 and did not report it; Seoul city reported it in 2026 after a police tip · Seoul city as reported by the press

How the facts developed

  1. Each person's leaked items confirmed with the police and the PIPC; texts to 4.62 million members (press)
  2. Seoul city briefing: after a suspected DDoS attack on the app on 28-30 June 2024, the server contractor gave Seoul Facilities Corporation a report of a data leak on July 18, 2024; the corporation did not report it. The police found member data while investigating another case and told the city on January 27, 2026 (press)

Outcome

Seoul city reported the leak to the PIPC and KISA and referred the operator's failure to report to the police; members whose data leaked get a 30-day pass worth KRW 5,000 (press). No PIPC decision.

Sources