South Korea's Nol Universe Reports Data Breach Affecting Domestic Hotel Bookings ...

Nol Universe said on Oct. 26 that an external hack leaked the personal data of customers who booked domestic accommodations through the former Interpark Tour. Nine data fields were exposed — including member ID, phone number, email, product name, purchase amount and date of use — and information on some employees and partner-company contacts also leaked. The company issued an apology and asked the Korea Internet & Security Agency (KISA) for technical support, but the full scope of the damage has still not been disclosed.

The breach occurred at 2:05 a.m. on Oct. 22. Nol Universe believes an outside attacker exploited a security vulnerability to gain unauthorized access to a function that retrieves booking information for domestic accommodations made through the former Interpark Tour. The affected bookings are those made between Feb. 15 and Sept. 8 of this year.

The nine exposed fields are member ID, membership number, booker name, user name, phone number, email address, product name, purchase amount and date of use. The company said booking data for Interpark Tour's flights, overseas accommodations, tours and tickets, as well as bookings made through the NOL service, were not part of this leak.

The incident was confirmed in addition to an earlier leak of employee data. Nol Universe had said in a notice on its website on Oct. 22 that three days earlier, on Oct. 19, an outside attacker gained unauthorized access to a function that retrieves employee information, exposing names, phone numbers, company email addresses, employee numbers and encrypted passwords for the internal system. A more detailed investigation then uncovered the leak of former Interpark Tour accommodation bookers' data on Oct. 24.

The company said it blocked the access route used in the attack and patched the security vulnerability immediately after learning of the incident, and strengthened its systems for detecting and blocking unauthorized access. To prevent further damage, it has temporarily suspended lookups of domestic accommodation bookings made through the former Interpark Tour before Oct. 23. It plans to resume the lookup service once security measures are complete.

"We offer our deep apologies for the breach," Nol Universe said. "We are continuing to determine the path and scope of the intrusion, cooperating fully with the relevant authorities, and will keep verifying additional facts and taking response measures while strengthening our security systems overall based on the investigation results." It added, "We will continue to monitor for further damage and will provide immediate notice of any newly confirmed details."

Because details and booking information were leaked together, the company urged customers to be wary of contacts impersonating hotels or booking platforms. It stressed that people should be cautious of suspicious emails, text messages and phone calls, and should not click links of unknown origin or enter personal information or credentials. Employees and partner-company contacts whose internal system passwords were exposed were advised to change them if they use the same password on other websites.

This is not the first data breach at Nol Universe. In July last year, a leak occurred at Interpark Global, its platform for foreign customers; in 2021, 52,000 records leaked from Yanolja Cloud; and in 2019, 70,000 records leaked from Yanolja Pension. In 2023, before Interpark was acquired by Yanolja, a credential-stuffing attack stole 784,920 pieces of personal data. With security incidents recurring across affiliated services for years, scrutiny of the group's overall management systems appears unavoidable.

Nol Universe has operated combined travel and performance booking services since merging "NOL Interpark Tour" and "NOL Ticket" in September. According to Mobile Index, NOL's monthly active users stood at 5.60 million (5,602,848) in September, ranking it at the top of the travel platform industry. With a platform that handles a substantial of domestic lodging and travel bookings leaking booking data on this scale, the risk of secondary harm such as phishing and smishing cannot be ruled out.

Customer data leaks from hacking incidents have been mounting in South Korea. An outside vendor that operates the booking and ticketing systems for Korean Air and Asiana Airlines was hacked, exposing some customer data, and personal information also leaked from Lotte-affiliated mobile gift certificate service Giftiel. In the financial sector, 16 institutions including Shinhan, KB Kookmin, Hana and Busan banks were attacked, exposing 100,000 pieces of personal data. As security incidents spread across travel, aviation, retail and finance, the key question will be what level of security investment and preventive measures Nol Universe puts forward in the wake of this breach.