Data Breach Exposes 1.3 M Accounts on Korean Interior‑Decoration Site ggumim.co.kr
What Happened – In March 2020 the Korean interior‑decoration portal ggumim.co.kr (operating under the “집꾸미기” brand) suffered a data breach that released the personal details of 1,298,651 registered users. The leaked records contain email addresses, full names, usernames and phone numbers, and were later posted in public hacking forums and indexed by HaveIBeenPwned.
Why It Matters for Trust & Control Assurance
- The incident illustrates the exact failure a continuous control‑assurance program seeks to detect: inadequate protection of personally identifiable information (PII) and insufficient monitoring of data‑access controls.
- Demonstrable evidence of robust access‑control policies, regular credential‑usage reviews, and audit‑ready logs would provide a defensible trail to show due diligence to regulators and partners.
- Mapping this breach to the “Data protection and privacy” control objective gives a single evidence point that satisfies multiple frameworks (e.g., NIST CSF 2.0, ISO 27001, GDPR).
Who Is Affected – Consumer‑facing e‑commerce / retail‑oriented web platforms that collect PII (retail‑e‑commerce, lifestyle SaaS).
Recommended Actions
- Conduct an immediate inventory of all PII stores and verify that encryption‑at‑rest and encryption‑in‑transit are enforced.
- Review and tighten authentication and authorization controls for user‑account data, adding multi‑factor authentication where feasible.
- Capture and retain detailed access logs for the affected data sets; integrate them into a continuous monitoring solution to generate audit‑ready evidence.
- Update privacy notices and incident‑response playbooks to reflect the breach scenario and test the response flow.
Source: HaveIBeenPwned breach record
Technical Notes
- Attack vector: Not publicly disclosed; likely a combination of credential compromise or mis‑configuration that allowed bulk extraction.
- Data types exposed: Email addresses, full names, usernames, phone numbers.
- Relevant CVEs: None reported; breach appears to stem from process or configuration gaps rather than a known software flaw.
Source: HIBP breach feed, breachbase.pw