Personal Info of 201 Delivery App Riders Leaked Without Hacking Tools

It has been confirmed that the personal information of approximately 201 delivery workers, including those from Baedal Minjok (Baemin), was exposed externally without any separate authentication procedures.

Earlier today (October 15), a data folder containing the names and phone numbers of about 201 delivery riders from platforms such as Baemin was exposed externally without a login screen on a site presumed to be operated by a domestic delivery agency, Company A.

This is based on the combination of rider IDs and names.

The site in question was individually created by the delivery agency for riders to independently check their information. It provides a service where riders enter their name, the last digits of their phone number, and a password to check their delivery performance.

However, unlike the service that requires user authentication, it was found that the data folder storing personal information could be accessed without any separate login screen.

This access was possible simply by adding a specific path to the web address, without requiring any special hacking tools or professional knowledge.

Consequently, possibilities have been raised that the operating company's access control management was inadequate or that security settings were omitted during the recently spreading generative AI-based development process.

Company A, suspected of being the operator of the site, is a delivery agency partner responsible for recruiting, dispatching, settling payments, and managing delivery riders.

Baedal Minjok stated that the site in question is neither a service provided or managed by Baedal Minjok nor is there a personal information consignment relationship with the agency in question.
※ Please note: This article was translated by AI and may contain errors.