Security alerts have been raised in the retail sector as customer data continues to be compromised following a major data breach at Coupang last year. Cyberattacks have even targeted supermarket refrigeration systems abroad. Concerns are growing over automated and advanced attacks utilizing artificial intelligence (AI), prompting the industry to reassess its security measures.
On October 19, coffee chain Hollys issued a statement revealing that it reported a data breach to the Korea Internet & Security Agency (KISA), estimating the scale of the breach at approximately 2.76 million cases. This includes cumulative customer data from 2009 to February 11, 2020, accounting for duplicate memberships. The leaked information includes usernames, passwords, names, birthdates, phone numbers, addresses, emails, duplicate membership verification information (DI), and service usage details.
Hollys identified that unauthorized access to its membership information was linked to a cloud service used for cryptocurrency mining.
On October 16, Hollys confirmed unauthorized access to its membership system, leading to the data breach, and sent individual notifications to customers on the night of October 18. The company determined that the breach occurred between September 3 and October 7, indicating that it took over a month to detect the intrusion.
Criticism has arisen regarding the adequacy of the customer notification process. There were no pop-ups or separate banners on the homepage alerting users to the data breach, requiring them to actively seek out the information. Additionally, there is no separate procedure for customers to verify whether their information was actually compromised.
Fashion platform 29CM also experienced a data breach on August 27, when external unauthorized access occurred in its order information retrieval function (API). Approximately 160,000 cases of personal information were leaked, including 138,841 names and 21,011 cases containing names, emails, phone numbers, and shipping information.
On June 4, BGF Networks, which operates CU convenience store deliveries, confirmed that customer information, including names, addresses, and contact details, was leaked due to external hacking. Last year, data breaches also occurred at GS Retail, BYN Black Yak, Adidas Korea, Dior, Tiffany & Co., Cartier, Mustit, Louis Vuitton, and Coupang.
The retail sector is particularly sensitive to cyberattacks due to the extensive range of information it holds. Retail companies manage names, contact details, addresses, purchase histories, and order and shipping information through apps, online stores, and memberships. As online and offline stores and logistics systems become more interconnected, the potential points of attack increase.
Internationally, threats have extended to store equipment. On November 11-12, approximately 700 supermarkets in France experienced cyberattacks that altered the temperature settings of refrigeration systems, with some temperatures rising to 50 degrees Celsius. It is believed that the attack targeted the systems and controls that remotely manage refrigeration equipment across multiple stores.
The industry is preparing for the possibility of automated and advanced AI-based attacks. SSG.com is enhancing its automated attack and abnormal access detection systems, while LF is improving ransomware prevention, personal data encryption, and access rights management. Starbucks has strengthened monitoring of attack IPs and bot-based login attempts, and CJ CheilJedang is implementing customer data encryption and conducting external penetration tests.
Experts emphasize the importance of proactive measures to identify and mitigate security vulnerabilities. Lim Jong-in, a professor at Korea University's Graduate School of Information Security, stated, "Using AI can help identify previously overlooked vulnerabilities much more easily, and attacks can be rapidly automated. In sectors like retail and logistics, which are relatively vulnerable to security breaches, customer information as well as store and logistics systems can become targets, so it is essential to strengthen vulnerability assessments and proactive defense systems using AI."
* This article has been translated by AI.
Copyright ⓒ Aju Press All rights reserved.