KB News Desk
Seoul has come under fire for offering users of its public bike-sharing service, Ttareungyi, a 30-day pass valued at 5,000 won ($3.41) following a cyberattack that exposed the personal information of 4.62 million members.
The leaked data included user IDs, phone numbers, dates of birth, gender, email addresses, postal codes, home addresses and body weight. For some users, guardians’ phone numbers, dates of birth and gender were also exposed.
“This makes me feel as though my personal information was worth only 5,000 won,” one user whose personal information was affected by the breach told The Korea Herald.
“What really bothers me lately is that there is nothing much we can do as a personal user and our only option is to change the password,” she added.
The Seoul Facilities Corporation reported that the cyberattack occurred between June 28 and 29, 2024, due to a security flaw in the Ttareungyi system. Police notified the operator of the breach on Jan. 27 after identifying two middle school students as suspects. Initial criticism centered on the nearly two-year delay between the Ttareungyi breach and its disclosure by the Seoul Facilities Corporation.
The Seoul Facilities Corporation stated there have been no confirmed cases of secondary damage from the breach. It is cooperating with police and the Personal Information Protection Commission in the ongoing investigation and will strengthen its security framework to prevent future incidents.
Chairperson Han Kook-young apologized for the leak and stated the corporation will make every effort to restore public trust and ensure the safety of the city’s bike-sharing service.
The Ttareungyi breach is the latest in a series of high-profile data leaks in South Korea, raising concerns about the adequacy of company and public institution responses, which often involve only apologies and minimal compensation.
Earlier this year, SK Telecom experienced one of the country’s largest cyberattacks, affecting millions of customers. The company provided free USIM card replacements, enhanced fraud monitoring and identity theft protection, and waived cancellation fees for departing customers.
In December, Coupang introduced a large compensation program to restore customer trust after a major data breach and announced plans to strengthen internal access controls and cybersecurity systems. However, critics argued that most benefits were tied to lesser-used services, limiting the program’s value for customers.
