From coffee memberships and e-commerce platforms to restaurant franchises, personal data leakage accidents are occurring one after another in the retail industry. Over the past three months alone, the scale of leaked data disclosed by major companies has exceeded 3 million cases. Although companies are expanding their information security organizations and increasing investments, security accidents continue to repeat at points connected to external systems, bringing the effectiveness of customer information management systems into question.

According to the retail industry on the 9th, SSG닷컴 identified a personal data leak on the 4th and reported it to the Korea Internet & Security Agency (KISA) on the 5th and the Personal Information Protection Commission on the 6th. An external unauthorized party exploited an API (Application Programming Interface) vulnerability to view some customer information. The leaked information mostly consisted of customer names and internal customer identification numbers, and the company individually notified the affected customers. No additional damage has been confirmed yet.

In the retail industry, personal data infringement accidents or leak possibilities have been successively confirmed starting with 29CM at the end of August, followed by Hollys, Gmarket, Giftiel, and Theborn Korea. A simple aggregation of the leakage scale of Gmarket, Hollys, 29CM, and Giftiel amounts to approximately 3.83 million cases. By company, the scales are 2.76 million cases for Hollys, about 900,000 users for Gmarket, about 160,000 for 29CM, and 18,359 for Giftiel.

The accident pathways were similar. For 29CM and Gmarket, customer information inquiry API vulnerabilities were used in the attacks. For Hollys, there was unauthorized access to cloud services where past membership information was stored. For Theborn Korea, circumstances of information extraction were found in the backup server of an ERP maintenance company. The scope of security management has expanded beyond internal systems to external services and partner companies.

The leaked information also expanded into forms connected to financial damage. At Gmarket, in addition to names, contact numbers, and addresses, e-coupon PIN numbers were leaked, and circumstances of unauthorized use of some coupons were confirmed. For Giftiel, coupon serial numbers and refund accounts were included in the leakage targets. Retail companies collect names, contact numbers, addresses, and purchase histories across purchasing, delivery, and membership accumulation processes, which broadens the scope of damage if an accident occurs.

As this situation repeats, companies are increasing their security organizations and investments. The Shinsegae Group newly established information security centers at SCK Company and E-Mart 24. Hyundai Department Store placed its information security organization directly under the Chief Executive Officer (CEO) and raised its target for the proportion of information protection investment relative to IT budget from 7% to 10%.

Gmarket also had a high information protection investment proportion of 9.7% relative to IT investment, but could not avoid this accident. Pointing out that rather than the scale of the budget, management capabilities to preemptively find vulnerabilities in areas that companies find difficult to directly control—such as external APIs, clouds, and partner company servers—are necessary. There are also voices calling for periodic inspections of the entire process from collection to storage and disposal.

An industry official stated, "As online transactions and membership services expand, the customer information and security threats that companies must manage also increase. It is difficult to recover customer trust with a method of responding after an accident occurs, so efforts are needed to regularly inspect data management systems and reduce security blind spots."

[Copyright (c) Global Economic Times. All Rights Reserved.]