---
title: Corporate welfare firm confirms customer data breach via API intrusion
url: https://www.dataloco.com/en/corporate-welfare-firm-confirms-customer-data-breach-via-api-intrusion
published: 2026-11-02T20:20:59+00:00
language: en
section: Security
source: https://www.dailysecu.com/news/articleView.html?idxno=209204
organizations: Hyundai Eziwell, Financial Supervisory Service, Korea Internet & Security Agency, Personal Information Dispute Mediation Committee
publisher: Dataloco
---

# Corporate welfare firm confirms customer data breach via API intrusion

Hyundai Eziwell, a provider of corporate welfare services, confirmed that customer personal information was leaked following an external hacking incident. The company stated that an attacker accessed the application programming interface used for member information inquiries in an abnormal manner. The firm verified the data leak after conducting an internal investigation into the security breach.

The leaked data comprised seven specific items: names, dates of birth, gender, mobile phone numbers, user IDs, email addresses, and residential addresses. The company has not disclosed the exact number of affected customers, the initial time of the intrusion, or the specific methods used by the attacker to gain access to the system.

Hyundai Eziwell detected the abnormal access attempts to the member information API at 9:00 p.m. on October 29. Immediately after confirming the incident, the company blocked the IP addresses used in the attack and completely cut off external access to the affected system. The firm also reported the incident to the Financial Supervisory Service and the Korea Internet & Security Agency. It is currently cooperating with these regulatory bodies to investigate the precise circumstances and the full scope of the data leak.

The attack targeted the API, which serves as a connection function for websites and mobile applications to query or process member data stored on servers. The company noted that insufficient verification of access rights or control over abnormal query requests can expose personal information to external risks. However, Hyundai Eziwell has not disclosed the specific vulnerability or attack technique used. It remains unclear whether authentication bypass or access control weaknesses were exploited, requiring further investigation.

The company stated that no secondary damages or cases of misuse of the leaked information have been confirmed so far. Hyundai Eziwell plans to notify affected customers individually about the incident and preventive measures. It warned that the leaked names, contact details, emails, and addresses could be exploited for phishing or smishing attacks, urging users not to open links or attachments from unknown sources.

The firm announced it would fully compensate for any damages confirmed as a result of the incident. Affected customers may claim damages under relevant laws or apply for dispute mediation through the Personal Information Dispute Mediation Committee. Following the incident, the company is conducting a comprehensive re-inspection of its security systems and vulnerabilities and has strengthened its 24-hour real-time security monitoring system.

Park Jong-sun, the representative director of Hyundai Eziwell, issued a formal apology on October 30. He expressed deep regret for the anxiety and concern caused by the failure to protect customer data. He emphasized that the company would responsibly and diligently handle all processes from preventing additional damage to establishing measures to prevent recurrence.

## This story in other languages

- [Deutsch](https://www.dataloco.com/de/kundendaten-bei-hyundai-ezwell-durch-hackerangriff-gestohlen)
- [Italiano](https://www.dataloco.com/it/hyundai-ezwell-subisce-un-attacco-hacker-con-conseguente-fuga-di-dati-personali-dei-clienti)
- [Nederlands](https://www.dataloco.com/nl/klantgegevens-gelekt-bij-hyundai-ezwell-door-hacking)