Personal Info of 201 Baemin Riders Exposed Without Hacking Tools

It has been confirmed that the personal information of approximately 201 Baemin riders was exposed externally without any separate authentication procedures.

The leakage path is presumed to be a site operated by a delivery agency partner commissioned by delivery platforms such Baemin and Coupang Eats.

Today (October 15), a data folder containing the names and phone numbers of about 201 Baemin riders was exposed externally without a login screen on a site presumed to be operated by a domestic delivery agency, company A.

This is based on the combination of rider IDs and names.

The site provides a service where Baemin riders can check their delivery performance by entering their name, the last digits of their phone number, and a password.

However, unlike the service that requires user authentication, it was found that the data folder storing personal information could be viewed without a separate login screen.

This access was possible simply by adding a specific path to the web address without any separate hacking tools or specialized knowledge.

Consequently, possibilities are being raised that the operating company's access control management was inadequate or that security settings were omitted during the recently spreading generative AI-based development process.

Company A, presumed to be the operating entity of the site, is a delivery agency partner responsible for recruiting, dispatching, settling payments, and managing riders under commission from domestic delivery platforms.
※ Please note: This article was translated by AI and may contain errors.