Security · October 27, 2026
Mobile coupon platform Giftiel hit by hacking, customer data exposed
A hacking incident at the mobile coupon platform Giftiel led to the exposure of customer personal information, including names, phone numbers, email addresses, and refund account details, raising concerns about secondary damage such as smishing, phishing, and financial fraud.
Spoon Co., the operator of Giftiel, confirmed the breach on October 22 through an official notice posted on its website, stating that unauthorized external access resulted in the leakage of some customer data.
The exposed data includes four categories: names, phone numbers, email addresses, and refund account numbers. However, the company did not disclose the exact number of affected users, the initial time of intrusion, the specific method used by the attackers to gain access, or the full scope of the data leak.
Giftiel provides mobile coupon issuance, authentication, sales, and settlement services, supporting approximately 3,000 products across around 150 brands, including major Lotte Group brands. Spoon completed electronic financial business registration in January 2025.
Upon detecting the breach, Spoon blocked the IP address used in the attack and strengthened system access controls. The company also reported the incident to relevant authorities and cybersecurity agencies, launched an investigation, and is enhancing database monitoring to prevent future incidents.
Affected customers are being individually notified via multimedia messages (MMS). However, based on the information currently available, it remains difficult to determine the full extent of the attackers' access, the specific systems involved, or the time elapsed between the occurrence and detection of the breach.
The inclusion of refund account numbers among the leaked data is particularly concerning. While account numbers alone cannot be used to withdraw funds directly, they can be combined with other personal information to facilitate fraud, such as impersonation during refund processing or financial institution scams.
Spoon has set up a dedicated channel for reporting damages related to the incident, including a team within the Digital Finance Planning Department and a specialized email address. The company stated that any reported cases of misuse or actual damage will be investigated and addressed in accordance with relevant laws and standards.
In an official apology, Spoon expressed regret for failing to adequately protect customer information and committed to implementing measures to prevent further harm and avoid recurrence.