Baedal Minjok delivery riders' data exposed via outsourcing partner
Approximately 201 delivery riders for South Korean food delivery platform Baedal Minjok (배달의민족) had their personal information exposed on a third-party delivery contractor's website server. The data was accessible externally without authentication.
Personal information belonging to approximately 201 delivery riders for the South Korean food delivery platform Baedal Minjok (배달의민족) was inadvertently exposed online. The data was found on the servers of a delivery outsourcing company contracted by the platform, and it was accessible to external parties without any form of authentication.
The website in question was intended for riders to check their delivery performance. While a normal login process required a rider's name, the last few digits of their phone number, and a password, the data folder containing personal details lacked a separate authentication mechanism. This oversight allowed unauthorized individuals to access the information by appending a specific path to the website's address.
Woowa Brothers, the operator of Baedal Minjok, stated that the incident is not directly related to their services. The full scope of the data exposure and the subsequent handling of the situation are still under investigation.