Travel booking platform confirms two separate data breaches

man with steel and chainmail armor holding sword — Henry Hustava / Unsplash

ZoomZoomTour, a travel reservation platform, has confirmed two distinct incidents involving the unauthorized exposure of personal information. The company disclosed that an external attacker accessed customer and guide data, while a separate development error left reservation details accessible to the public for approximately two years. The platform issued a formal apology and detailed the scope of the incidents in a notice signed by its representative director on November 6.

The first incident involved an external attack that began on November 4, 2026, at approximately 3:30 p.m. The attacker registered as a member and exploited security vulnerabilities in specific service functions to view the data of other customers and guides. Exposed customer information included names, email addresses, phone numbers, traveler details entered during booking, and payment amounts. For some customers, voucher files and customer service chat logs were also compromised. The company stated that temporary links to voucher files were valid for 15 minutes and had all expired by November 4. Guide information exposed in this attack included names, aliases, photos, introductions, interview answers, and for some guides, email addresses, phone numbers, and KakaoTalk IDs. The attack also triggered unauthorized cancellation requests for some orders, which the company restored on the same day without affecting payments or refunds.

The second incident was a development error on the review page. Reservation information linked to reviews was not displayed on the screen but was included in the page data, making it accessible to visitors and search engines. This exposure lasted from November 6, 2024, to November 4, 2026. Specific data points appeared at different times; for example, booker phone numbers were included from November 13, 2024, while seller contact and business information remained exposed until November 5, 2026. The affected parties included customers who wrote reviews during this period, their travel companions, and the sellers of the reviewed tours. Customer data exposed in this error included names, email addresses, phone numbers, and booking details such as tour dates, party sizes, and pickup locations. Seller data included names, KakaoTalk IDs, and business registration numbers.

ZoomZoomTour stated that it blocked the attacker's access and locked the compromised account on the day the incident was detected. The company reported the incidents to the Korea Internet and Security Agency and the Personal Information Protection Commission. It also removed customer reservation information from the review page on the day the error was found and obscured author names the following day. The company requested the removal of cached pages from search engines and the Internet Archive. It confirmed that resident registration numbers, passport numbers, dates of birth, card numbers, account numbers, and passwords were not exposed. The total number of affected individuals and the overlap between the two incidents were not disclosed. The company warned users to be cautious of impersonation attempts by hackers claiming to be the platform, guides, or travel agencies.