Baemin Riders’ Personal Information Exposed for 201 People ... Company Says It Is Verifying the Facts
IT DAILY ·
✦ AI Summary
The site operated for checking delivery performance was believed to have been run by a domestic delivery agency, Company A.
Its personal-information storage folder could be accessed without a login procedure, and signs were confirmed that names and phone numbers had been exposed externally.
Signs of personal information exposure involving about 201 Baemin riders were confirmed, and Woowa Brothers is aware of the matter and is verifying the specific circumstances.
The site, which appears to have been operated for checking delivery performance, was likely run by a domestic delivery agency, Company A. Its function was to let riders check their delivery results. According to industry sources on the 15th, the site’s input fields for queries were a name, the last digits of a phone number, and a password, and normal access required user authentication.
However, it was found that the data folder storing personal information on the same site could be accessed without a login procedure. The exposed location was a data folder containing names and phone numbers, and it was confirmed that the folder could be viewed externally without separate authentication.
As a result, signs of personal information exposure involving about 201 Baemin riders were confirmed. The exposed information included names and phone numbers, and the count was based on combinations of rider IDs and names.
Woowa Brothers, the operator of Baemin, is aware of the matter. Woowa Brothers said it is in the process of confirming the specific circumstances.
The incident is believed not to have required hacking tools or sophisticated intrusion techniques. It was confirmed that the data folder could be accessed simply by adding a specific path to the web address. However, the period during which the personal information was exposed to the outside has not yet been confirmed, and it has also not been confirmed whether a third party viewed or downloaded it.
Company A is described as a delivery agency partner that has carried out rider recruitment, dispatch, settlement, and management work based on outsourcing from a delivery platform. However, based on the information confirmed so far, it is difficult to conclude that Baemin's own system was compromised, and it also cannot be said that personal information was leaked directly from Baemin.
Accordingly, further verification is needed regarding the process by which the information was stored on Company A's site in order to determine how the incident occurred. Additional confirmation is also needed as to who was responsible for handling the personal information, and the duration of the exposure must also be checked. In particular, how Company A obtained riders' names and phone numbers is presented as a key issue in determining the scope of responsibility.
A Woowa Brothers official said the company is aware of the matter and is verifying the facts. The company is currently identifying the specific circumstances of the exposure and is also checking the scope of the damage.
Source: IT DAILY · Kim Byeong-ju
Original: https://www.itdaily.kr/news/articleView.html?idxno=242202
References
This article was produced with the help of an automated content generation algorithm.
Source: IT DAILY
View originalThis article was summarized and organized by BizCrush based on the original article from IT DAILY. For exact quotations and full details, please refer to the original article.