Chak is back online. What happens to the 3,083 users whose data was exposed?

The Korea Minting and Security Printing Corporation, known as KOMSCO, said an unauthorized outsider accessed Chak, its mobile local-currency voucher platform, and viewed personal information belonging to 3,083 people. That was the assessment at 6 a.m. on November 14, 2026, Korean Standard Time—not an established final total. The corporation has apologized and is investigating the cause with relevant authorities.⁠2⁠3⁠13

The most useful distinction in the disclosure is not between “about 3,000,” as the KBS headline described the scale, and the precise count of 3,083. Those figures are consistent. It is between the different information exposed for different people: 3,072 users had two or fewer fields viewed, while 11 had three or four. The number of fields alone does not tell a customer how sensitive their particular exposure was.⁠1⁠2

Across the incident, the information involved seven categories: names, birth dates, mobile telephone numbers, bank account numbers, connecting information identified as CI, email addresses and encrypted card numbers. That is an incident-wide list, not a description of what happened to every affected user. KOMSCO gave examples of two-field combinations: a name and birth date, or CI and an encrypted card number. The disclosure does not establish that all 3,083 people had bank account information exposed.⁠2⁠3

Nor does it establish that usable, unencrypted card numbers were obtained. The corporation described the card numbers as encrypted, but the available account does not explain the strength of that protection or whether an intruder could defeat it. “Encrypted” is a relevant qualification, not enough information to settle the risk. Unauthorized viewing also does not, by itself, establish that money was taken.⁠2⁠3

KOMSCO first detected signs of abnormal access at approximately 9:30 a.m. on November 13, Korean Standard Time. That gives investigators a point on the clock, but not a complete timeline. It is the time the corporation noticed something wrong, not a verified time when the outsider first entered. How the access was gained and how long it lasted remain unresolved in the available reporting.⁠2⁠3

The corporation’s reported response proceeded from blocking suspected attack IP addresses to blocking overseas IP access altogether. It then identified the targeted server, suspended the affected service and applied emergency security measures before restoring normal service. No precise restoration time was provided. The overseas block describes a containment measure; it does not establish the attacker’s identity or nationality.⁠2⁠3

KOMSCO also reported the incident to the Korea Internet & Security Agency, or KISA, and said it was cooperating with relevant agencies and strengthening system security against further unauthorized access and misuse of exposed information. These detailed accounts, published by Yonhap and Korea Economic Daily, reproduce the corporation’s explanation. They are not an independently published technical investigation demonstrating how the breach happened or that every weakness has been resolved.⁠2⁠3

For customers, the immediate need is more specific than the platform-wide total: which information was viewed in their own case? KOMSCO says it is informing customers about the confirmed facts, the fields viewed and precautions against further harm. The available account does not specify how those notices are being delivered or establish that every affected person has received an individual notice.⁠2⁠3

The corporation has urged users to be particularly alert to voice phishing and smishing—fraudulent telephone calls and text messages. That warning addresses the possibility that exposed details could be used to target customers. It is not a finding that such fraud has already occurred, and the available reporting provides no confirmed financial-loss assessment.⁠13

“We deeply apologize to the public,” an unnamed KOMSCO official said, in an English translation of remarks reported by Yonhap. The official acknowledged the responsibility of a public institution entrusted with protecting personal information and pledged to focus its capabilities on preventing further harm and protecting customers.⁠2

The apology recognizes the obligation; the investigation still has to explain the failure. The outstanding questions are concrete: the route into the system, the duration of access, whether the affected population grows beyond the November 14 assessment and whether anyone misuses the exposed information. No completion date for that work has been established. Restored service is an operational milestone, not the end of the incident for people whose information was viewed.⁠2⁠3⁠13