In recent days, a string of personal data leaks through application programming interfaces (API) has occurred. From online fashion malls to fandom and aesthetic medical platforms, hackers have exploited vulnerabilities in APIs, which are platform integration features, regardless of industry. As a result, the importance of API Security is growing across the industry.
◇ B2C platforms hit by successive API attacks leaking personal information
According to the security industry on the 8th, Healing Paper, which operates the aesthetic medical platform Gangnam Unnie, said that on the 4th there was abnormal access to the consultation history inquiry API, leading to a leak of some customers' personal information. The company blocked the path as soon as it detected the abnormal access, but the leak had already occurred, and the next day it confirmed indications that the same attacker attempted to access again through a different path. On the 6th, it secured indications to identify the attacker and requested an investigation from the competent police station.
The incident leaked information on 219,665 domestic and overseas customers, including about 160,000 users in Korea and about 48,000 users in Japan, as well as users in Taiwan, Thailand and China. The leaked items included not only basic information such as names and contact information, but also consultation registration photos, preferred reservation times, motives for consultation, identifiers of medical practitioners, and information related to actual procedures and payments.
Weverse said in a notice on the 6th that 422,584 cases of personal information, based on account IDs, were leaked. Weverse Company received a tip on the 3rd from the Korea Internet & Security Agency (KISA) about security vulnerabilities in the service and confirmed the leak after conducting a self-check. The leaked items included internal identification information generated during the membership registration process, payment methods, payment gateway (PG) names, payment currency, and purchase/cancellation amounts and times.
Hwahae, a cosmetics information platform, reported to the Korea Internet & Security Agency (KISA) on the 2nd that it had confirmed abnormal access by an external actor to some customers' personal information. The leaked items were event shipping address information of some members and member information disclosed in review posts. Passwords, payment/financial information, and resident registration numbers were not believed to have been leaked.
At 29CM, an online fashion mall operated by Musinsa, abnormal external access occurred on the 27th of last month to the order information inquiry API, leaking 159,852 cases of customer personal information. After confirming the incident, the company blocked the access path and voluntarily reported the personal information leak to KISA. As for the leaked items, names of 138,841 people were exposed, while for 21,011 people, names, email addresses, mobile phone numbers and shipping information were leaked. Payment information and login account information such as IDs and passwords were not believed to have been leaked.
◇ Targeting gaps in API authorization checks and repeated calls… "API calls rising with the spread of AI agents"
Regarding the successive API leak incidents, the security industry notes that in B2C platforms, which are heavily integrated with external services, APIs—the channels for data exchange—are becoming vulnerable points for cyberattacks. An API is a connection channel that allows different programs or services to exchange data and functions according to set rules. For example, it is used when a shopping app retrieves order details from an order management system or when a finance app pulls balances and transaction histories from a bank system.
API security incidents occur when a server only checks whether a user is logged in but does not verify access permissions for each piece of information, or when it does not limit bulk or repeated calls. Attackers exploit a "broken object level authorization (BOLA)" vulnerability by changing identifiers such as member numbers or order numbers included in API requests to view other users' information, or they automate calls to collect large amounts of data. They may also abuse unmanaged "shadow APIs" or "zombie APIs" left behind after service overhauls as bypass routes. Because these requests appear similar in form to normal service usage, it is difficult to distinguish malicious activity with just existing firewalls.
In response, the Personal Information Protection Commission urged in July to strengthen preventive measures against leakage of personal information through APIs. The Personal Information Protection Commission recommended excluding unnecessary personal information from API responses and verifying permissions for viewing and editing information for every request. It emphasized granting different access permissions by user, administrator and partner; limiting bulk and repeated calls; and deleting or revoking unnecessary APIs and keys/tokens unused for long periods. It also ordered checks of access logs to detect abnormal activity such as late-night access or mass queries.
Experts note that with API calls surging due to the spread of AI agents, corporations must strengthen authentication/authorization systems and abnormal behavior detection. Kim Myeong-ju, a professor in the Department of Information Security at Seoul Women's University, said, "As AI services shift to agent-based models, API calls will inevitably increase," and added, "The authentication and authorization procedures that confirm user identities and define the scope of accessible data and functions must be designed in a granular way."
Kim added, "If a user shows usage patterns different from usual—such as consecutively querying multiple data or systems beyond the initially allowed scope—it should be judged as a warning sign. If you do not analyze usage behaviors and logs in real time from the moment you open APIs, you may only recognize an incident after information has already been leaked," stressing, "Do not stop at opening APIs; expand security investments, monitoring, and management personnel."