GiftiL Hack Leaked Refund Customers' Bank Details

Hackers took the names, mobile phone numbers, email addresses and refund bank account numbers of some customers of GiftiL, a Lotte-affiliated mobile voucher service in South Korea, according to Chosunbiz and Yonhap. GiftiL’s operator, Spoon, confirmed on 22 October that unauthorised outside access had led to the leak, both outlets reported on 25 October.

The data belongs to customers who typed in their bank account details when applying for voucher refunds, not to every GiftiL user, Chosunbiz reported. Spoon has not said how many people are affected, and neither report gives a number. The scale of the leak is still being assessed.

In brief

Spoon, the company behind GiftiL, says outside attackers reached customer data; it confirmed the breach on 22 October.
Four items leaked for refund applicants: name, mobile number, email address and refund account number, according to Chosunbiz.
No victim count has been published, and its parent says no compensation plan has been settled.

Who runs GiftiL, and what it sells

GiftiL sells mobile exchange vouchers for Lotte-affiliated food and drink brands. A voucher can be swapped for a specific item, such as a Lotteria bulgogi burger set or an Americano at Angel-in-us, and GiftiL handles both issuing those vouchers and refunding them, Chosunbiz reported.

Spoon is wholly owned by Daehong Communications, Lotte Group’s advertising affiliate, according to Chosunbiz; Yonhap describes it as a Daehong subsidiary. Chosunbiz notes that GiftiL is a different service from Lotte Mobile Gift Certificate, the department-store stored-value certificate run by Lotte Members.

GiftiL also runs GiftiL Biz, a platform companies use to send mobile gift vouchers as promotional prizes or staff perks. It carries about 3,000 products from around 150 brands, including Lotte Mart, Lotte Cinema, Starbucks and Baemin, Chosunbiz reported. Neither outlet says whether GiftiL Biz customers are among those affected.

Spoon says it blocked the attacker and called in the authorities

After discovering the incident, Spoon blocked the attacking IP address and tightened access controls on its systems, according to both reports. It reported the case to a security agency and to the relevant government departments and asked them to investigate. Yonhap reported that Spoon is now investigating jointly with the authorities, has stepped up monitoring of access to its database and is drawing up measures to stop a repeat.

Affected customers are being told individually by MMS text message. In a notice on its website, Spoon told customers to be wary of texts, emails and calls from unknown sources and not to click suspicious links, Yonhap reported. If they suspect fraud using the leaked account details, it recommends checking their accounts through Korea’s integrated account information management service and, where needed, suspending payments, Chosunbiz reported.

“We deeply apologise once again for failing to keep your valuable information safe,” Spoon says in the notice, according to Yonhap (TSN translation).

A Daehong Communications official told Chosunbiz: “We are verifying the extent of the damage, and no specific compensation plan has been finalized yet.” The official added: “We will do our best to prevent further harm and recurrence.”

The leaked group is the one that handed over bank details

The detail that matters is where the leaked data came from. According to Chosunbiz, the affected customers are those who typed in a bank account to get a refund, so the breach hit exactly the customers who had handed over banking details. The leak therefore reaches people who were trying to get money back, and it pairs a working contact number with a real account number.

That combination is what makes Spoon’s phishing warning more than routine. A scam text that quotes a victim’s own name, phone number and bank account is far more convincing than a generic one, and refund applicants have a real reason to expect messages from GiftiL about money. The same pattern ran through HomeToGo’s SECRA breach, where bank details were also among the data that may have been taken.

It also extends a run of Korean consumer leaks this month, after Hollys Coffee’s membership breach and Taekwang’s OneDrive account leak.

The count and the compensation are both still missing

Spoon has said who was affected and what was taken, but not how many people, when the attackers got in or how. Daehong’s official has also said compensation is undecided. Until a number is published, refund applicants cannot tell whether this is a small incident or a large one, and the advice to check bank accounts applies to all of them.

TSN follows breaches like this one, and Alliance Medinet’s in Singapore, on its ransomware and cyber-attack hub. For anyone who has asked GiftiL for a refund, the practical step is to treat any message about that refund as suspect until it is checked through GiftiL directly.