An attacker exploited a security flaw at Nol Universe, the South Korean company behind the NOL travel and leisure platform, and pulled booking records belonging to customers of its former Interpark Tour domestic accommodation service, the company said on 26 October. The records include names, phone numbers, email addresses, the stays booked, the dates and the amounts paid, according to its notice as quoted by Yonhap.
It is the company’s second breach disclosure in a week. On 22 October Nol Universe said an attacker had reached an internal staff lookup tool, and that notice still sits on its corporate homepage. The company has not said how many customers or bookings are affected.
In brief
- Nol Universe says an attacker reached a booker lookup function on 22 October and took 9 data items.
- Bookings of former Interpark Tour domestic stays made between 15 February and 8 September 2026 are affected.
- A separate 19 October attack exposed staff data, later including encrypted internal passwords.
What the customer notice says
The attack happened at 02:05 Korea time on 22 October, Newsis reported, citing the notice. An outside attacker used a security weakness to make abnormal use of the former Interpark Tour domestic stay booker lookup function. Affected are bookings made between 15 February and 8 September 2026.
The nine items listed are member ID, member number, booker name, guest name, phone number, email address, product name, purchase amount and stay dates. Flights, overseas hotels, tours, tickets and bookings made through the NOL app are not affected, the company said. The notice gives no number of affected customers or bookings.
“We sincerely apologise for causing concern,” Nol Universe said, according to ZDNet Korea. “We will keep checking for further damage and will inform you immediately of anything newly confirmed.”
What the company has done
Nol Universe says it blocked the route the attacker used, fixed the weakness and strengthened its systems for detecting and blocking abnormal access. It has asked the Korea Internet & Security Agency (KISA) for technical support. ZDNet Korea reported that lookups of former Interpark Tour domestic stay bookings made before 23 October have been suspended while security work continues. The company says the suspended range differs from the leak period and that lookups will resume soon, according to Newsis. Customers can check whether they are affected on a lookup page.
The notice asks customers to treat unexpected emails, texts and calls with suspicion, and not to open links from unknown sources or enter personal or authentication details through them.
The staff breach three days earlier
The first incident was disclosed on 22 October. According to the company’s homepage notice, an outside attacker used a security flaw at 02:40 on 19 October to reach a function for looking up staff information. The leaked items were names, phone numbers, company email addresses and staff numbers. On 24 October the company added a further item: encrypted passwords for internal systems. It asked anyone who uses the same password elsewhere to change it, Newsis reported.
At the time, a company official told Newsis that on the 19th it had found that the data of two users, as well as some employees and partner staff, had leaked. The company said it had reported that incident to KISA and other agencies. It has not said whether the two attacks are linked.
Booking details make a scam call easier to believe
Most leaks give fraudsters a name and a phone number. This one adds the hotel, the dates and the price paid. A caller who can name a customer’s hotel, dates and price sounds like the hotel or the booking platform, and asking for a card number to process a “refund” or “rebooking fee” then sounds routine. That is why the company’s warning about texts and calls matters more here than in a typical leak. The same logic ran through the GiftiL refund-account leak, where the stolen records matched people expecting money back. Customers who booked domestic stays through Interpark Tour this year should check the lookup page and treat any call about a past booking as suspect until they have checked it in the app.
Two lookup tools fell in three days, and the count is still missing
Both attacks went through a lookup function, one for staff and one for bookers, three days apart. The company describes each as abuse of a security weakness. It has not said whether the same weakness was involved, and until it does customers cannot tell whether the first breach should have prevented the second. It also follows the Hollys and Yonsei University leaks this month; TSN tracks them on its ransomware and cyber-attack hub.
The lookup page can tell each customer whether they were hit. Nol Universe has yet to say how many were.
Sources
- Nol Universe: corporate homepage notice on the staff data incident, 22 October 2026, updated 24 October
- Nol Universe: personal data leak lookup page
- Nol Universe: customer data leak notice, 26 October 2026, as quoted by Yonhap, Newsis and ZDNet Korea
- Yonhap: Nol Universe apologises for customer and staff data leaks, 26 October 2026
- Newsis: Nol Universe customer data leak report, 26 October 2026
- Newsis: Nol Universe user and staff data leak report, 22 October 2026
- ZDNet Korea: Interpark Tour domestic stay booking data leak, 26 October 2026
Related stories
- Lotte Voucher Service GiftiL Leaked 4 Data Items in Hack, Reports Say
- Hollys Coffee Says Hackers Leaked Members’ IDs, Passwords and Addresses
- Yonsei University Says Portal Hack Exposed Data of About 10,000 Students
- Korean Integrator Taekwang Admits OneDrive Account Data Leak
- Ransomware and Major Cyber Attacks: TSN Story Hub
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
