The personal data of approximately 201 delivery riders working for the South Korean platform Baedal Minjok was exposed due to a security flaw at a third-party logistics contractor. The information was stored on a server belonging to the outsourcing firm.
The contractor's website, designed for riders to check their performance metrics, required a name, the last digits of a phone number, and a password for authorized access. However, the data folder containing the records lacked a proper authentication mechanism.
External parties could access the sensitive information by simply appending a specific path to the website address. This bypass allowed anyone to view the data without undergoing the standard verification process.
Woowa Brothers, the operator of Baedal Minjok, stated that the incident is not directly related to their own services. The company has not yet provided details on the full scope of the breach or the next steps for remediation.
