Breach · · 3 min read
Gmarket says gift voucher PINs and home addresses leaked, and some vouchers were spent by others
Korean shopping site Gmarket says an intruder used a flaw in an outside service to reach names, voucher PINs, phone numbers and addresses. Losses are being repaid in full.
Gmarket is one of South Korea’s largest online shopping sites. On October 30, 2026, it said some customers’ mobile gift vouchers had been registered and used by other people without their knowledge, and that customer details had been exposed. If you shop on Gmarket, here’s what it has said so far.
What happened
Customers first noticed it themselves. According to the Seoul Economic Daily, Gmarket’s customer service received complaints that department store and Culture Land gift vouchers stored in people’s Gmarket e-coupon boxes had already been redeemed when they tried to use them. Gmarket said it blocked the unauthorized access route, took emergency security measures and reported the incident to the Korea Internet & Security Agency (KISA) on October 30. SBS reported the same day that the scale and cause were still being worked out.
On November 1, Gmarket gave more detail, the Seoul Economic Daily reported. Unauthorized access attempts began at 2:11 p.m. on October 27, using a flaw in an outside service’s API. The exposed information includes:
- name and Gmarket ID
- e-coupon PIN numbers
- phone number and email address
- home address
Gmarket says login passwords weren’t exposed. It hasn’t said how many customers are affected. It filed a report with the Personal Information Protection Commission on November 1 and plans to refer the case to investigators.
What Gmarket is doing for customers
Gmarket says it has repaid customers with confirmed losses from voucher misuse in full, in Smile Money. It has also given 10,000 won in Smile Cash to every customer whose information was exposed, whether or not they lost anything. To stop further misuse, it is replacing the PINs of vouchers customers still hold, in stages.
This is the latest in a run of gift voucher leaks in Korea. The Seoul Economic Daily notes that SK Planet’s Gifticon service detected signs of a leak earlier, and that Giftiel, run by Spoon, lost the personal information of 18,359 customers in a hacking attack on October 22.
What you can do
- Check your Gmarket e-coupon box. Look for vouchers marked as used that you didn’t use, and report them to Gmarket.
- Watch for your new voucher PINs. Gmarket is replacing the PINs of vouchers customers still hold, in stages. Don’t share an old PIN with anyone.
- Be careful with texts, calls and parcels that use your name and address. With a home address and phone number, scammers can pose as a courier or as Gmarket. Gmarket has been telling affected customers with a pop-up notice in its app; open the app yourself rather than following a link.
- Change your password if you reuse it. Passwords weren’t exposed, but your ID and email were, which makes reused passwords easier to try elsewhere.
- Learn the patterns. See how scammers use leaked data.
How Frame helps
Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Automatic breach lookups aren’t live yet. Frame also watches data-broker sites for your home address and phone number, the details that make a fake delivery message believable. Frame never collects or stores the leaked records themselves.
Sources
- Seoul Economic Daily, G Market Hit by Breach as E-Coupon PIN Numbers Leak, October 30, 2026
- SBS, Gmarket Reports Unauthorized Use of E-Coupon PINs to KISA, October 30, 2026
- Seoul Economic Daily, Gmarket Pays 10,000 Won to Customers Hit by Data Breach, November 1, 2026
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.