SSG.com Data Breach Exposes Customer Names via API Flaw

Timeline and response

SSG.com says it discovered the breach on November 4 and began adding security measures. It reported the incident to the Korea Internet & Security Agency (KISA) on November 5 and to the Personal Information Protection Commission on November 6. The same day, it notified the affected customers individually.

A company representative said no additional harm from the leak has been confirmed so far. The representative added that the company will do its utmost to protect customers and prevent a recurrence.

Why it matters

The data involved appears limited, with names and internal identifiers making up most of what was exposed. Still, the case shows how API weaknesses can give outsiders a path to customer records on large e-commerce platforms. Names combined with other data are often used in phishing and impersonation attempts, so affected customers may want to treat unexpected messages with caution.

The incident adds to a run of recent data breaches in South Korea, including those at an online learning platform and an education company earlier this year. The company has not said how many customers were affected or how long the vulnerability was open to abuse.