Two South Korean teenagers were charged following a massive cyberattack on Ttareungyi, Seoul’s public bike-sharing service. The breach, which took place in June 2024 when the suspects were still in middle school, compromised approximately 4.62 million records—roughly 90% of the service’s total user base.

Key Details of the Breach

• The Suspects: Two high school students (Persons A and B) who met via Telegram.
• Data Stolen: The haul included user IDs, phone numbers, email and home addresses, dates of birth, and users’ weights.
• Excluded Data: Fortunately, names and resident registration numbers were not leaked.
• The Vulnerability: The pair exploited a weakness in the Seoul Facilities Corporation’s server that allowed them to bypass authentication tokens.
• Motive: One suspect claimed he did it for “personal bragging rights.” Police found no evidence that the data was sold to third parties.

Legal Status

• Charges: Both were referred to prosecutors without detention for violating the Information and Communications Network Act.
• Arrest Warrant: An arrest warrant for Person A was rejected by the prosecution because of their status as a juvenile offender.
• Corporate Accountability: Authorities are also investigating the Seoul Facilities Corporation for potential violations of the Personal Information Protection Act regarding negligent security.