Nol Universe reports data breach of Interpark Tour domestic accommodation customers

Nol Universe has confirmed a personal information leak involving customers who booked domestic accommodations through the former Interpark Tour platform. The breach occurred on October 22 at approximately 2:05 AM, when an external attacker exploited security vulnerabilities to gain unauthorized access to the domestic accommodation reservation inquiry function.

The leaked data includes nine categories of information: member IDs, member numbers, names of the person making the reservation, names of the users, phone numbers, email addresses, product names, purchase amounts, and dates of use. The breach affects reservations made between February 15 and September 8 of this year. However, bookings for flights, overseas accommodations, tours, tickets, and NOL services were not affected.

Nol Universe has blocked the access route used in the attack, patched the vulnerability, and strengthened its abnormal access detection systems. As a precaution, the service for viewing reservation details made before October 23 has been temporarily suspended. The company has requested technical support from the Korea Internet & Security Agency (KISA) to prevent further damage and has advised customers to be cautious of suspicious emails, texts, or calls.

This incident follows another smaller breach reported by the company on October 19, which involved the personal information of two users and several employees and partners.