Customer Contact Information and Addresses Exposed... Korea Papa John's Suffers Personal Data Breach

Personal Information Protection Commission Launches Investigation

A personal information exposure incident has occurred at Korea Papa John's, a pizza franchise.

On June 26, Korea Papa John's released a statement on its website, announcing that "a vulnerability was recently discovered that could have allowed some customer information to be exposed externally." The company explained, "The exposed information includes customer names, contact numbers, and addresses. In the case of card information, it was confirmed that some digits of the 16-digit card number were masked."

The company added, "We took immediate action regarding the case reported the previous day, and we have now completed all necessary security measures and are operating as usual."

Papa John's stated, "We feel a heavy sense of responsibility for causing concern to our customers due to inadequate management," and added, "We will establish a more thorough personal information management manual and conduct a comprehensive review of our security systems. We will implement rigorous safety checks to prevent similar incidents from recurring."

The company further emphasized, "We will determine whether any specific damages have occurred, and if confirmed, we will promptly notify affected customers and take appropriate protective measures."

Papa John's reported the personal information exposure incident to the Personal Information Protection Commission the previous day. The report is said to include details such as the scale and cause of the exposure.

The Personal Information Protection Commission plans to investigate the specific circumstances of the exposure, the extent of the damage, and whether technical and administrative safety obligations were fulfilled. The commission will also focus on whether order information was retained beyond the personal information retention and usage period specified in the privacy policy, and if any violations are found, it will take action in accordance with relevant laws and regulations.