'No signs of direct breach to exchange systems so far'

[Coinone]
[Coinone]

Virtual asset exchange Coinone said personal information of its customers was leaked after a hacker broke into the servers of an outside firm handling its customer support operations. There are no signs that the exchange's account or trading systems were directly compromised, but information customers left during support interactions was exposed to the attacker.

Coinone said it confirmed Sunday morning, around 8 a.m., that an unauthorized party had broken into the servers of MetaM, its outsourced customer support provider, and accessed or extracted customer support data. The attacker gained illegal access to MetaM's servers at around 4 a.m. Thursday, and Coinone said it was notified by the vendor at around 9:20 a.m. the same day.

Information potentially exposed includes phone numbers, names, email addresses, dates of birth, bank account numbers, passwords, resident registration numbers, ID card issuance dates, home addresses, virtual asset wallet addresses and transaction identification numbers (TXIDs) that customers had provided during chat or phone support sessions. The specific items exposed may vary by individual depending on the content of each customer's interactions. Coinone said it plans to prepare a separate notification service and a personal data breach lookup tool so customers can check which of their details were affected.

Coinone's member account, trading and virtual asset wallet systems operate on infrastructure separate from MetaM's servers. The exchange said there are no signs to date that those systems were directly breached. The exact timing and circumstances of the data leak are under investigation in cooperation with the vendor and outside specialists.

Immediately after learning of the incident, Coinone switched its outsourced customer center to email-only support and blocked the IP addresses used in the attack as well as access to the customer center. The exchange also stepped up real-time monitoring of abnormal logins and transactions, and filed reports with the Korea Internet & Security Agency, the Personal Information Protection Commission and the Financial Supervisory Service. Coinone said it is also conducting a direct review of the vendor's security management practices.

Secondary harm — including impersonation and identity theft using the leaked support data — is also a concern. Coinone urged customers who shared passwords during support sessions to change their account passwords immediately, and to update the same password on any other sites where it was used. The exchange also warned that calls or messages referencing specific details of past support interactions could be impersonation attempts.

"We will conduct a comprehensive review and strengthen the security management framework not only of our own systems but also of the partner companies to which we entrust operations," Coinone said, apologizing for the incident. "We will provide updates on confirmed developments and measures taken through future notices."


forest@heraldcorp.com