Unauthorized Gift Certificate Purchases at KT Alpha... "Login Using Externally Collected Information"

"Unauthorized Purchases Attempted Using Stolen Accounts and Registered Cards"
KT Alpha Conducts Comprehensive Investigation... Financial Supervisory Service Launches Probe

An incident occurred on 'Giftishow,' the mobile gift certificate service operated by KT Alpha, in which unauthorized purchases of gift certificates were made using cards registered to accounts that had been accessed by impersonating other users. Amid a series of massive personal information leaks this year at companies such as Coupang and SK Telecom, concerns are being raised that this may represent secondary damage resulting from those breaches. The Financial Supervisory Service has launched an investigation into the matter.

According to KT Alpha on December 23, on December 14, an incident occurred on its mobile gift certificate service Giftishow, where attackers illegally obtained account credentials from outside sources, logged in, and made unauthorized purchases of gift certificates using cards already registered to those accounts. Upon detecting the incident, the company canceled the entire amount of unauthorized transactions and reported the incident to the relevant authorities the following day.

A KT Alpha representative explained, "This incident involved account theft, where attackers accessed accounts and made purchases using illegally collected login credentials from external sources," adding, "The KT Alpha system itself was not hacked."

It has been determined that the payments were made using cards that had been pre-registered to the affected accounts. For cards registered via simple payment methods, it was possible to make high-value purchases with just a click, without requiring additional passwords or biometric authentication. However, some users on online communities have reported that their cards were registered and used for payments without their knowledge, even though they never registered their card information themselves. A company representative stated, "We are currently conducting a full investigation and are also verifying the facts regarding these claims."

So far, financial authorities have identified around 10 victims. The total amount of damages is reported to exceed 10 million won. In some cases, attempts were made to purchase gift certificates dozens of times, resulting in approximately 1.5 million won worth of gift certificates being bought on a single account.