ENKR

White Essence booking site and core system data breach

Add to my breach check

Made public · 1,050,000 accounts

What leaked10

Replaceable

  • Password

Hard to replace

  • Mobile number
  • Home or delivery address
  • Email address
  • Employer
  • Other profile data
  • Username

Permanent

  • Date of birth
  • Full name
  • Gender
  • Passwordthe notice says the passwords were encrypted; the method is not stated
  • Mobile numberphone number · type not stated
  • Employerworkplace
  • Full nameitems differ from person to person
  • Other profile datadata on service use and how the company handled it, and the company's management numbers; customers with other items leaked are being contacted individually
  • Usernamelogin ID

To-dos6 · about 1 h 30 min in all

  1. Change the leaked password everywhere you reused itabout 30 minfreeStops: account takeover
  2. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  3. Use an authenticator app or passkey instead of SMS codesabout 20 minfreeLimits harm from: account takeover, SMS code theft
  4. Turn on instant transaction alertsabout 5 minHelps you notice: scam calls
  5. Turn on two-step sign-in for email and bankingabout 15 minfreeLimits harm from: account takeover
  6. Remove your address and phone from public profiles and tighten SNS privacyabout 20 minfreeLimits harm from: visits or contact at home

What happened next12 events

  1. UndetectedNone on record
  2. Response 12 eventsNo individual notice on record · Back to latest
  3. RemedyNone on record
  4. PenaltyNone on record
  5. DisputesNone on record

Response: 12 events

Back to latest
  1. No secondary harm from the incident found as of the notice
  2. Apologised in its notice
  3. Announced that customer personal data had been taken out: about 1.05 million accounts
  4. Contacting each customer whose contact details could be confirmed, in turn
  5. Opened a toll-free phone line for the incident: daily until 23 September, weekdays from 24 September
7 more
  1. Opened a temporary customer desk for the incident
  2. Announced the unauthorised access and the suspension; affected data still under investigation
  3. Suspended its booking site and core system
  4. Found unauthorised access to its booking site and core system
  5. Reporting to and consulting the police and other authorities
  6. Fixed the exploited flaw and added a system that detects and blocks unauthorised traffic
  7. Reported to the Personal Information Protection Commission
Company
White Essence
Company detected it
Made public
Notice
Leak confirmed
Affected
1,050,000 accounts · approx.; registered as of August 5, 2026; customers plus people connected with member clinics, head-office staff and others; company notice

Sources