SSG.com, the e-commerce arm of South Korea's Shinsegae Group, has reported a data breach after hackers exploited a flaw in a publicly available application programming interface (API) to view customer information. The company confirmed the leak on Friday 6 November.

The leaked information consisted of customer names and internal customer identification numbers, the company said in a notice to customers. The exact number of affected customers has not been disclosed, and the company says no additional damage has been confirmed so far. The company has individually notified the customers affected.

SSG.com detected signs of the leak on Tuesday 4 November and took additional security measures. It reported the incident to the Korea Internet and Security Agency on 5 November and completed a filing with the Personal Information Protection Commission on 6 November. An SSG.com official said the company would do its utmost to prevent damage to customers and to keep the incident from happening again.

A familiar flaw in Korean e-commerce

The breach follows a similar incident at rival marketplace Gmarket, where attackers exploited a flaw in an external service's API to redeem customers' e-coupons and view personal data; Gmarket said on 2 November it had finished compensating all affected customers. The two cases underline how exposed web services connected to retailers' core systems have become a repeated entry point for attackers in South Korea.

SSG.com runs same-day and scheduled delivery through Emart and Traders Wholesale Club stores across the country. Customers who receive messages claiming to be from the company about the leak should verify them through the firm's official app or website rather than acting on unsolicited links.