The Giftiel data breach is a leak of refund-applicant data from Giftiel, a mobile gift-voucher service operated by Spoon Inc. Spoon confirmed on 22 October 2026 that unauthorised external access had leaked refund-applicant data; ChosunBiz reported on 25 October that Spoon put the figure at 18,359 refund applicants. The affected group was limited to customers who had applied for voucher refunds, and the leaked set combined a financial detail with contact details for each affected customer.
The leaked items were exactly four: name, mobile phone number, email address and refund account number. The same four items were listed across the reporting outlets, and no outlet listed passwords, payment card details or voucher balances among them. Each affected record contains a financial detail alongside contact details. The outlets that reported the incident were English translations of Korean reporting, so refund account number and bank account number describe the same listed item.
Operator and service
Spoon Inc. operates Giftiel and is a subsidiary of Daehong Communications, an advertising affiliate of the Lotte Group. ChosunBiz reported that Spoon is wholly owned through 100 percent equity by Daehong Communications. Giftiel issues and sells mobile exchange vouchers for Lotte-affiliated brands, including Lotteria and Angel-in-us, and it handles inquiries about voucher use and refunds. A voucher in this system is exchanged for a specific product, and a refund of a voucher requires a destination account for the payment.
Giftiel also operates Giftiel Biz, a corporate platform for sending promotional prizes and employee gifts in bulk. Maeil Business Newspaper reported that the corporate platform carries about 3,000 products from more than 150 brands. Giftiel is a different service from Lotte Mobile Gift Certificate, a digital stored-value certificate for Lotte Department Store operated by Lotte Members.
Chronology
Spoon detected signs of abnormal activity from unauthorised external access at 19:16 on 22 October 2026, according to ChosunBiz. Spoon confirmed on the same day that some customers' personal data had leaked, suspended the service, blocked the attack IP and strengthened system access controls. SBS reported that Spoon also strengthened database access monitoring and began a joint investigation with the relevant authorities.
On 23 October 2026, Spoon reported the incident to the Personal Information Protection Commission, the Korea Internet and Security Agency and the Financial Supervisory Service at 16:30, and requested an investigation by law enforcement. The service resumed at 17:20 on 23 October after vulnerabilities were fixed and security checks were carried out. Spoon began notifying affected individuals one by one by MMS from 19:22 on 23 October. On 25 October, an earlier piece said the specific scale of the leak was still being assessed, while a later piece the same day gave the figure of 18,359 customers and said that an investigation into the specific cause and the scale of damage was still underway.
| Date and time | Event |
|---|---|
| 22 October 2026, 19:16 | Abnormal activity from unauthorised external access detected |
| 22 October 2026 | Leak confirmed, service suspended, attack IP blocked, access controls strengthened |
| 23 October 2026, 16:30 | Incident reported to the Personal Information Protection Commission, the Korea Internet and Security Agency and the Financial Supervisory Service, with a law-enforcement investigation requested |
| 23 October 2026, 17:20 | Service resumed after fixes and security checks |
| 23 October 2026, 19:22 | Individual MMS notification of affected customers began |
| 25 October 2026 | Earlier reporting said the scale was still being assessed; later reporting gave the figure of 18,359 customers |
Data exposed and affected customers
The leaked information was not data for all Giftiel users. The affected customers were those who directly entered bank account information when applying for coupon refunds, and a customer who only bought or received vouchers without ever applying for a refund was not described in any outlet as part of the affected group. The affected group is smaller than the full Giftiel user base, and every affected record contains a financial detail alongside contact details. A name, a phone number, an email address and a refund account number together allow an attacker to craft messages that reference a real refund and a real account.
The affected group is limited to refund applicants, not all Giftiel users. The count of 18,359 is Spoon's reported figure as carried by ChosunBiz on 25 October 2026, and it is not presented here as a final audited total while the investigation into the scale of damage remains open.
Spoon's reported position on losses was narrow. ChosunBiz reported that no monetary damage from fraudulent coupon use had been confirmed so far. That wording is limited to fraudulent coupon use, and it is Spoon's report rather than an independent finding, so it does not establish that no victim suffered any other form of loss. A Daehong Communications official said the scope of damage was still being confirmed and no specific compensation plan had been finalised, according to both ChosunBiz pieces. As of 25 October, customers waiting for a compensation decision had no plan to point to.
Company response and published guidance
Spoon published a notice and apology on the Giftiel website, and the outlets quoted and screenshotted that notice. SBS reported Spoon's apology for failing to safely protect customer information and its statement that it would do its utmost to prevent additional damage and recurrence. NoCut News reported a similar apology and a warning to be especially careful with texts, emails and calls from unclear sources and not to click links from unclear sources. The direct website notice itself could not be fetched as text during research for this article, and Maeil Business Newspaper reported that access to the website was blocked at that time because of a system emergency security check, so the apology wording here is given as reported by those outlets rather than as a verbatim quote from the notice.
Spoon urged affected customers to be cautious with text messages, emails and phone calls from unclear sources and not to click suspicious links. Where misuse of bank account information was suspected, Spoon recommended checking accounts through the integrated account management service and, if necessary, taking payment-suspension measures. Spoon also operated a channel for receiving reports of harm and published guidance on its website to prevent secondary damage, according to ChosunBiz. The leaked email address can be checked against known breaches through Have I Been Pwned, and the general method is described in the AliasFleet guide on how to check if an email address was leaked. The leaked phone number and account number are not covered by an email breach check, which is why Spoon's guidance pointed to account management and payment-suspension measures instead. The pattern of attack to watch for after a leak of this kind is described in the AliasFleet guide on how phishing uses a leaked email address, and a separate AliasFleet guide covers how to check if an email message is phishing.
Refund applications
The account number in each record was supplied in a refund application. The account number was entered by the customer into a refund application, because a voucher refund needs a destination account for the payment. That ordinary refund mechanism is also the reason the exposed set is both small and sensitive: only customers who asked for money back supplied the number, and each of those customers supplied it in a form held by the same service. Giftiel holds bank details only for the subset that requested refunds, so a breach affecting refund records exposes a smaller group.
No outlet read stated a root cause, an entry point, a vulnerability or an attacker, and no attack method beyond unauthorised external access was described. Whether the leaked account numbers were full numbers or partial numbers was not stated in any outlet read, and this article does not add that detail. The risk in each record therefore rests on the combination of fields listed, not on any additional technical detail that the sources do not supply.
AliasFleet and separate addresses
AliasFleet provides managed, persistent email aliases, with a separate alias for each service, so that a breach at one service exposes only the alias used for that service and not the primary inbox address. In a case like the Giftiel breach, that separation limits one part of the exposure: the leaked email address would be the Giftiel alias rather than the address used for banking, work or personal mail, and the alias for Giftiel could be paused or replaced without changing the primary address. The AliasFleet guide on how to secure an email account describes the account measures that sit alongside alias use, including strong passwords and two-factor authentication on the destination inbox.
The limit of that protection belongs in the same description. An alias does not protect a bank account number typed into a refund form, because the number is stored by the service itself and not by the email provider. An alias does not protect a mobile phone number supplied to the same service, and it does not undo a leak of a name. AliasFleet also does not change what a service stores, how long it stores it, or who inside that service can read it. The value of a separate alias in this incident is containment of the email address, not containment of the whole record.
Unresolved questions
The cause of the breach remained under investigation when the 18,359 figure was reported, and no entry point, vulnerability or attacker was named in the outlets read. Whether the leaked account numbers were full or partial numbers was not stated, whether any victim has since reported fraud is unknown from the sources read, and no specific compensation plan had been finalised as of 25 October. The count itself may still change, since the earlier report on 25 October said the scale was being assessed while the later report gave a figure and also said an investigation into the scale of damage was underway.
No regulator statement was found in the outlets read, so this article reports only Spoon's report to those bodies and not any regulator finding. A later update to this article should check the regulator record, the compensation decision and any revised count before treating any of those points as settled. The dated sequence, the four leaked items and the refund-applicant scope are settled; the cause, the form of the account numbers and the compensation decision are not.
Top comments (0)