The Nol Universe data breach is the unauthorised access on 22 October 2026 to domestic lodging booking records of former Interpark Tour customers. The records included email addresses, phone numbers and booking details, and the number of affected customers has not been disclosed. The records covered domestic lodging reservations in South Korea made between 15 February and 8 September 2026. Nol Universe confirmed the incident on 26 October 2026 and stated that an external attacker exploited a system vulnerability at 02:05 on 22 October to reach the domestic lodging booker lookup function.
The incident
Nol Universe provides travel and event reservation services formed from the merger of NOL Interpark Tour and NOL Ticket. On 26 October 2026 the company published a notice titled "Notification of personal information leak following a security breach" on its official website, as reported by Herald Business. The facts in this article are attributed to that notice as reported or quoted by the outlets cited, because the company notice itself was not fetched as text for this article. The notice, as reported, stated that an outside attacker exploited a security vulnerability to gain unauthorised access to the function used to look up domestic accommodation reservation details on the former Interpark Tour platform.
The sequence of dates separates the attack, the discovery and the disclosure. The customer records were accessed at 02:05 on 22 October 2026, and the customer leak was uncovered on 24 October 2026 during a more detailed investigation that followed a separate employee information leak, according to BigGo Finance. The apology and notice came on 26 October. No Nol Universe notice URL was found, so no notice screenshot is embedded in this article. A Nol Universe official apologised for the incident, said the company was identifying the intrusion path and scope, said it would cooperate fully with the relevant authorities, and said it would strengthen its security system based on the investigation results, as reported by ChosunBiz.
Platform scale is distinct from the size of the breach. According to Mobile Index, NOL monthly active users in September 2026 totalled 5,602,848, ranking first in the travel platform industry, as reported by Edaily. That figure measures how many people used the platform in that month. It is not a count of affected customers, and it must not be read as one.
The figure 5,602,848 is NOL monthly active users in September 2026, reported by Mobile Index. It is not a count of affected customers, and the number of affected customers has not been disclosed.
Data exposed
The exposed set ran to nine categories for the affected domestic lodging bookings: member ID, member number, booker name, user name, phone number, email address, product name, purchase amount and date of use. In Herald Business wording, the last two fields are guest name and check-in date. A contact address is paired with a specific booking record. A message that names a real hotel product, a real purchase amount and a real date of use is harder to dismiss as generic spam than a message that contains only an email address, and that pairing is the basis for the impersonation risk described in the warnings section below.
The scope of the leak was limited to one booking channel and one booking type. Interpark Tour flights, overseas lodgings, tours and tickets were excluded, and bookings made through the NOL service were also excluded. Those exclusions are stated in all four sources read for this article. Neither a victim count nor a reservation count was disclosed. Herald Business reports no disclosure of the number of affected customers or the total number of reservations involved, and Edaily reports no disclosure of the specific extent of the breach. No source read for this article states confirmed misuse of the leaked data. BigGo Finance states only that the risk of secondary harm such as phishing and smishing cannot be ruled out, and that statement is a risk assessment rather than a confirmed outcome.
The separate employee incident
Nol Universe disclosed a separate attack on 22 October 2026. The employee lookup function was reached by abnormal access on 19 October 2026, when an external attacker exploited a vulnerability, according to ChosunBiz and BigGo Finance. Names, phone numbers, company email addresses, employee numbers and encrypted internal system login passwords made up the leaked employee information. Herald Business describes the same incident in different terms, as exposing personal information of some employees and associates at partner companies, including names, phone numbers, corporate email addresses and employee identification numbers, and its version does not mention passwords. Edaily separately notes that personal information of some employees and representatives of partner companies was leaked, without tying that sentence to one incident or the other.
No source read for this article links the two incidents through a shared vulnerability or attacker, and no such common cause is claimed here. The customer leak was uncovered during the investigation that followed the employee leak. Employees and partner company contacts whose internal system passwords were exposed were advised to change those passwords if the same password is used on other websites, according to BigGo Finance. That advice concerns password reuse, which is the mechanism by which one leaked credential can give access to other accounts, and the guide on how an email breach and a password breach relate describes that connection in detail.
Actions taken by Nol Universe
After identifying the incident, Nol Universe blocked the access route used in the attack, patched the vulnerability, and strengthened its system for detecting and blocking abnormal access. The company also requested technical support from the Korea Internet and Security Agency (KISA) to prevent further damage and for follow-up measures, according to ChosunBiz and Herald Business. The reservation history lookup service for former Interpark Tour bookings made before 23 October was temporarily suspended while the vulnerability is addressed, according to Herald Business and BigGo Finance, and BigGo Finance reports that the company plans to resume the lookup service once security measures are complete.
Edaily summarises the company position as blocking external access routes, reporting the matter to relevant authorities, announcing the incident and its response measures, and notifying those affected by the leak. The sources read do not confirm whether notification was individual or general, and individual notification is not presented here as a settled fact. Affected users were informed, in the company notice as reported by Herald Business, that civil damages or statutory compensation may be sought under the Personal Information Protection Act, with remedies available through the Personal Information Dispute Mediation Committee or the Personal Information Infringement Report Center. That remedies wording comes from the company notice as reported by Herald Business, rather than from Herald Business itself.
Previous incidents
Edaily reporting places earlier leaks in the background of the current incident, and that history is not presented as part of the October 2026 incident. Last July brought a personal information leak on Interpark Global, the platform for foreign users operated by Nol Universe. Interpark lost 784,920 personal information records to a credential stuffing attack in 2023, before its acquisition by Yanolja. The 2021 leak from Yanolja involved 52,000 customer records, and the 2019 leak from Yanolja Pension involved 70,000. BigGo Finance reports the same figures, with the 2021 incident labelled Yanolja Cloud. The incidents listed above show repeated leaks across affiliated services over several years, and the guide on how data breaches happen sets out the common mechanisms behind such repeated incidents.
Warnings to customers
Customers were told to treat suspicious emails, text messages and phone calls with caution, to avoid links of unclear origin, and to avoid entering personal or authentication information, according to ChosunBiz, Edaily and BigGo Finance. BigGo Finance further reports a warning against contacts impersonating hotels or booking platforms. A message that claims to concern a real booking, a refund or a change to a stay, and that asks for credentials or payment details, fits the pattern the company warned about. The guide on how phishing uses a leaked email describes how a leaked address plus booking details can be used to build a convincing impersonation message, and the guide on how to check if an email is phishing sets out checks for such messages.
Known breach listings can be checked for an email address through Have I Been Pwned, and that check is explained in detail in the AliasFleet guide on how to check if an email address was leaked. The nine customer fields in this leak contain no passwords, so the password advice in this incident belongs to the separate employee incident, where reused internal passwords were the exposure. Changing a reused password limits the damage from any credential that was exposed, whether or not the credential came from this incident.
Email aliases and booking services
AliasFleet assigns a separate managed alias to each website or service, with each address forwarding to one inbox. If a service leaks its copy of an address, the alias points to that service, and the alias can be paused or replaced while addresses used elsewhere stay unchanged. A breach is not prevented by that mechanism, and booking details, phone numbers and payment data held by the service are not protected by it. The limit of that mechanism is the address: it governs where mail from that service arrives and whether that address keeps working, not what the service stores. The guide on how email aliases actually work describes that mechanism in full.
With a dedicated alias, a booking service holds an address used nowhere else, which makes a later message to that alias from any other sender easier to recognise as unrelated to the booking. That setup is explained in the guide on using a different email for every website. The bank account stands outside this pattern: a bank keeps a permanent real dedicated address used only for financial accounts, never an alias, because recovery, statements and fraud alerts depend on that address. No such constraint applies to travel bookings, and aliases are intended for services other than the bank account.
Top comments (0)