Hacking of Giftiel Leads to Service Disruptions for LOTTE EATZ

black computer keyboard on brown wooden table — Jessica Lam / Unsplash

A hacking incident at Giftiel, a mobile coupon service under the Lotte Group, has extended its impact to the LOTTE EATZ membership service.

Spoon, the operator of Giftiel and a subsidiary of the advertising agency Daehong Planning, discovered signs of system abnormalities on October 22 at approximately 7:16 PM. An investigation confirmed that unauthorized external access resulted in the leak of personal information belonging to 18,359 customers. The compromised data includes names, mobile phone numbers, email addresses, and refund account numbers.

In response to the breach, Spoon blocked the attacking internet protocol addresses and strengthened system access controls. The company reported the incident to relevant authorities, including the Personal Information Protection Commission and the Korea Internet and Security Agency, and requested an investigation by law enforcement. Affected customers were notified individually via text messages.

To prevent further damage and conduct security checks, Spoon suspended Giftiel mobile coupon services starting October 26 at 8:30 PM. This suspension disrupted the inquiry, use, approval, and cancellation of coupons for 24 brands, including Lotte Cinema, Krispy Kreme Doughnuts, Angel-in-us Coffee, and Lotteria.

LOTTE EATZ, an integrated dining platform operated by Lotte GRS, posted a notice on its official application on October 28 regarding the membership coupon disruptions. The company stated it will provide compensation for customers who could not use coupons because they expired during the system check period. Specifically, the validity periods for birthday and membership grade-up coupons will be extended once the system is normalized. For mileage coupons, the company will re-credit the mileage equivalent to the expired coupon amount, and stamp coupons will be restored by re-crediting the existing stamps.

Spoon plans to uniformly extend the validity of mobile coupons that could not be used during the service outage by 30 days. The operator aims to normalize services by November 4 after completing necessary security measures. LOTTE EATZ noted that its own systems were not hacked and no member information from LOTTE EATZ was directly leaked.