--- title: Hanpass reports customer data breach involving sensitive identity documents url: https://www.dataloco.com/en/hanpass-reports-customer-data-breach-involving-sensitive-identity-documents published: 2026-11-08T17:21:08+00:00 language: en section: Security source: https://www.dailysecu.com/news/articleView.html?idxno=209335 organizations: Hanpass, KISA, KAIT publisher: Dataloco --- # Hanpass reports customer data breach involving sensitive identity documents Hanpass, a fintech company providing international remittance and lifestyle services for foreigners, confirmed that an external hacking attack resulted in the leakage of some customers' personal information. The breach exposed not only basic identity details but also original copies of sensitive documents, including income certificates and foreigner registration fact certificates, raising concerns about potential secondary harm. The company stated that the estimated time of the data breach was around 4:38 a.m. on November 1, 2026. Hanpass detected the incident at approximately 10:00 a.m. on the same day, meaning it took about 5 hours and 22 minutes from the initial intrusion to the company's awareness of the event. The breach occurred when an external attacker gained unauthorized access to the system through an application programming interface. The leaked information included original copies of income certificates and foreigner registration fact certificates, as well as the names, nationalities, phone numbers, payment information, and addresses of Hanpass Mobile subscribers. Income certificates may contain personal income data, while foreigner registration fact certificates may include identity information related to foreigner registration. The specific details contained in the leaked documents will determine the risk of secondary harm, such as identity theft or financial fraud. However, the company has not disclosed the exact number of affected customers, the number of leaked certificates, the specific type of API accessed, or whether authentication was bypassed. Further verification is required to determine the scope of the external data exfiltration. Hanpass operates a mobile-based international remittance service and provides financial convenience services for foreigners residing in the country. The company also offers lifestyle services, including prepaid cards, mobile wallets, job recruitment, and administrative consultation. The incident is notable because it involves original identity and income verification documents rather than just basic membership information. Depending on the actual scope of the information obtained by the attacker, there is a possibility of targeted voice phishing, SMS phishing, or fraud attempts using the identity documents. However, the company's notice did not confirm that any such secondary harm has actually occurred to date. Upon detecting the incident, Hanpass blocked the unauthorized access path and strengthened firewall and system security checks. The company also completed emergency security measures, including strengthening API key authentication, to prevent further damage. Hanpass reported the incident to the Personal Information Protection Commission, the Korea Internet & Security Agency, and the Financial Services Supervisory Service, and is cooperating with the related investigations. Customers were advised to be cautious of phishing attacks via phone calls, text messages, and emails impersonating Hanpass. Those concerned about identity theft were directed to use the name misuse prevention service M-Safer from the Korea Information and Communication Technology Promotion Association or credit inquiry blocking services from credit rating agencies. Hanpass stated that it will proceed with damage relief and compensation procedures in accordance with company regulations and relevant laws if actual damage occurs. Future investigations will focus on which part of the API authentication and access control system was exploited, whether access permissions to the original certificates were appropriately restricted, and the actual scale of the data leakage. According to the company's official website, it supports remittances to over 200 countries, with a cumulative total of 13 million remittance transactions and over 10 trillion won in cumulative remittance amounts. ## This story in other languages - [ไทย](https://www.dataloco.com/th/story-106) - [Español](https://www.dataloco.com/es/una-brecha-de-seguridad-en-hanpass-expone-documentos-sensibles-de-clientes-mediante-un-ataque-a-la-interfaz-de-programacion-de-aplicaciones) - [Deutsch](https://www.dataloco.com/de/datenschutzverstoss-bei-hanpass-sensible-dokumente-und-kundendaten-durch-hackerangriff-abgeflossen) - [Italiano](https://www.dataloco.com/it/hanpass-violazione-dei-dati-e-fuga-di-documenti-sensibili-dopo-attacco-hacker) - [Polski](https://www.dataloco.com/pl/wyciek-danych-osobowych-klientow-hanpass-w-wyniku-ataku-hakerskiego)