[Listed Companies at a Crossroads] Hanpass ① Customer Data Leaked in Hack... Security Investment Pledge Rings Hollow

Personal information, including income certificates, leaked externally... Scale of breach under investigation
Promised to strengthen security infrastructure when it listed in March, but a breach occurred

Hanpass, a fintech company specializing in overseas remittances, suffered a data breach in which customers' personal information was leaked in an external hacking attack. The exposure of sensitive customer information at a company that provides financial services such as overseas remittances, e-wallets and prepaid cards has heightened concerns about its security management systems.

Hanpass had said when it went public on the KOSDAQ that it would invest part of its IPO proceeds in strengthening information security and service infrastructure. However, a hacking incident less than a year after its listing is expected to deal an unavoidable blow to customer trust.

On November 3, Hanpass posted a notice and apology on its website regarding the personal information breach, disclosing that customer information had been leaked in an external hacking attack.

According to the company, the hacking attack began at around 4:38 a.m. on November 1. The attacker attempted unauthorized external access through an API, and the company found evidence that some customers' personal information had been leaked during the attack. The company first reported the possibility of abnormal access to its chief information security officer at 10 a.m. that same day, after detecting it.

Hanpass said that, following a report from its security monitoring provider, it began blocking the attacker and analyzing logs from the time the attack started. However, more than five hours elapsed between the start of the attack and the initial report.

The leaked information consisted of original copies of issued certificates, including income certificates and certificates of alien registration. For Hanpass Mobile subscribers, the exposed information reportedly included names, nationalities, phone numbers, payment information (prepaid or postpaid) and addresses. The company said no other personal information was leaked.

However, the exact times and number of times the information was accessed have yet to be confirmed, as has whether the attacker captured the information on screen or saved it separately. Hanpass said it could not provide details while it investigates the circumstances with relevant authorities, including the Financial Supervisory Service. It said the leak confirmed so far involves Hanpass customer information, and that no leak of customer information from other affiliates, including Hanpass Financial, has been confirmed. The scale of the breach is also under investigation.

A Hanpass representative said, "Immediately after becoming aware of the incident, we blocked unauthorized access and strengthened firewall and system security checks. We have completed emergency measures to prevent further damage, including strengthening API key authentication, and have also filed reports with the relevant authorities, including the Personal Information Protection Commission, the Korea Internet & Security Agency (KISA) and the Financial Supervisory Service."

Founded in 2017, Hanpass obtained licenses for currency exchange and small-value overseas remittance businesses from the Financial Services Commission that same year. After launching its mobile overseas remittance service in 2018, it expanded its business, partnering with Western Union to provide overseas remittance services to 200 countries. It later obtained licenses for electronic payment gateway (PG) services and the issuance and management of prepaid electronic payment instruments, and entered the mobile wallet and prepaid card businesses.

More recently, the company has expanded beyond overseas remittances into services such as recruitment for foreign nationals, mobility and commerce, positioning itself as a comprehensive financial and lifestyle platform for foreign nationals. In March 2026, it was listed on the KOSDAQ.

The hacking incident has raised market concerns about Hanpass's security systems. For a financial services company, trust in customer data protection and security systems is fundamental to its business.

Hanpass had previously said at the time of its listing that it planned to use part of its IPO proceeds to strengthen information security and service infrastructure. However, market concerns are expected to grow further given that the company failed to prevent a personal information breach caused by hacking despite improving its security infrastructure.

A Hanpass representative said, "If this incident causes customers actual harm, we will provide remedies and compensation in accordance with relevant regulations and laws. We will also review our entire security system for protecting customer information from the ground up."

This content was produced with the assistance of AI translation services.