Police Refer Two Suspects in "Ddarungi" Data Leak Case Without Detention

Two Teenage Male Suspects Referred Without Detention
4.62 Million Records Leaked, Including IDs and Phone Numbers

Two teenage men who leaked the personal information of members of Seoul’s public bicycle service “Ddarungi” have been handed over to the prosecution.

The Cyber Investigation Unit of the Seoul Metropolitan Police Agency announced on the 23rd that in June 2024, it had referred without detention Mr. A and Mr. B on charges of violating the Act on Promotion of Information and Communications Network Utilization and Information Protection, after they allegedly hacked into the “Seoul Bike Ddarungi” server and leaked about 4.62 million items of personal information, including subscriber IDs and phone numbers.

On November 18 last year, a Ttareungi storage facility was installed near Exit 2 of City Hall Station on Sejong-daero in Jung-gu, Seoul. Photo by Kang Jinhyung

According to the police, Mr. B is also suspected of having carried out a DDoS attack in April of the same year on the server of another shared mobility rental company, thereby disrupting its equipment rental operations. In October that year, the police identified and arrested Mr. B as the perpetrator of the DDoS attack, seized all of his electronic devices, and in July last year discovered a file that appeared to contain Ddarungi personal information, which led them to continue the investigation.

Subsequently, the police identified an anonymous Telegram account and, through technical tracking, arrested the main culprit, Mr. A, around the end of last month. During the investigation, Mr. A refused to make a statement, and although the police applied twice for an arrest warrant, the prosecutor declined to request it, citing reasons including the fact that he is a juvenile offender.

Mr. A is accused of leaking subscriber IDs, phone numbers, email addresses, residential addresses, dates of birth, gender, and weight. Names and resident registration numbers were not included.