Personal Info of 201 Delivery Riders Exposed Without Hacking Tools

Personal information for approximately 201 delivery riders, including those working for Baemin (Woowa Brothers), was found exposed externally without any authentication procedures.

Today, a data folder containing the names and phone numbers of about 201 delivery riders from platforms such as Baemin was exposed externally without a login screen on a site presumed to be operated by a domestic delivery agency, company A.

This is based on a combination of rider IDs and names.

The site in question was individually created by the delivery agency for internal lookup of rider-related information. It provides a service where riders can check their delivery performance by entering their name, the last digits of their phone number, and a password.

However, unlike services that require user authentication, the data folder storing personal information was found to be accessible without any separate login screen.

This access was possible simply by adding a specific path to the web address, requiring no special hacking tools or professional knowledge.

As a result, concerns have been raised that the operating company's access control management may have been inadequate, or that security settings might have been omitted during the development process utilizing generative AI, which has recently been spreading.

Company A, presumed to be the operating entity of the site, is a delivery agency partner responsible for recruiting, dispatching, settling, and managing delivery riders.

Baemin stated that the site in question is neither a service provided or managed by Baemin, nor does it have a personal information consignment relationship with the agency in question.
※ Please note: This article was translated by AI and may contain errors.