Gmarket explains "unauthorized payment" is not a hacker attack... account theft is the cause

Regarding the recent incident of customers suffering unauthorized payments on the G Market, the company has concluded that this was not due to an external hacker attack, but rather originated from the theft of existing account information. Representative James Zhang explained that no signs of external intrusion were found in this incident; instead, the perpetrator appears to have used stolen information to log in legally before attempting payments.

The incident came to light on November 29 last year when some G Market users reported payments made without their knowledge. It is reported that there were more than 60 victims, each suffering a loss of less than 200,000 KRW. G Market immediately blocked the IP addresses involved in the incident, enhanced its payment security policies, and stated that no further losses have occurred since.

The company suspects that the cause of the incident was “account takeover” using personal information illegally collected from external sources. If individuals use the same username and password combination across different websites, any leak of that information through any channel can result in damage—a common tactic. Particularly, this incident coincided with Coupang’s announcement on the same day of a leak affecting 33.7 million accounts, which heightened security concerns throughout the e-commerce industry.

G Market, taking the situation very seriously, has proactively reported to the Financial Supervisory Service, decided to provide prompt compensation to affected customers, including refunds, and advised them to report to the police and other relevant authorities. The company also stated that it will use this incident as an opportunity to comprehensively strengthen its security measures.

This incident serves as a reminder of the risks associated with the widespread habit of “reusing accounts” in society. Experts point out that, as cybersecurity threats become increasingly sophisticated, it is crucial for users to follow basic security practices, such as using different passwords for different websites. In the future, the entire e-commerce industry is likely to focus on strengthening personal information protection and enhancing customer authentication systems as core priorities.