[Edaily Reporter Kim Una ] Nol Universe suffered a hacking attack, resulting in the leak of personal information belonging to customers who booked domestic accommodations through Interpark Tour. According to Nol Universe on the 26th, at 2:05 a.m. on the 22nd, an external attacker gained access to Interpark Tour’s domestic accommodation reservation inquiry function and leaked customer data.

The data breach reportedly involved domestic accommodation reservations made through Interpark Tour between February 15 and September 8 of this year, based on the reservation dates. The leaked information includes nine items: member ID, membership number, reservation holder’s name, user name, phone number, email address, product name, purchase amount, and date of use. It was also confirmed that the personal information of some employees and representatives of partner companies was leaked.
Nol Universe did not disclose the specific extent of the breach, such as the number of affected customers or the number of reservations. However, the company stated that Interpark Tour’s reservations for flights, international accommodations, tours, and tickets, as well as reservations made through the NOL service, were not included in this data breach.
Nol Universe stated, “Immediately after becoming aware of the incident, we blocked external access routes, reported the matter to relevant authorities, announced the circumstances of the incident and the status of our response measures, and notified those affected by the leak,” adding, “Currently, some inquiry services have been suspended to address the security vulnerability.” The company went on to urge users to “be wary of suspicious communications such as emails and text messages, and take care not to click on links from unknown sources or enter personal information and authentication credentials.”
With a series of personal information leaks occurring on platforms operated by Nol Universe, questions regarding responsibility for lax security management are likely to arise. In fact, last July, a personal information leak occurred on Interpark Global, a platform targeting foreign users operated by Nol Universe. Interpark also had 784,920 personal information records stolen in a credential stuffing attack in 2023, prior to its acquisition by Yanolja. In 2021, 52,000 customer records were leaked from Yanolja, and in 2019, 70,000 records were leaked from Yanolja Pension.
A Nol Universe spokesperson stated, “We are cooperating fully with the relevant authorities and continuing to verify the facts and implement corrective measures,” adding, “Based on the investigation results, we will comprehensively strengthen our security systems.”
Meanwhile, Nol Universe has been providing travel and event reservation services since last September by merging “NOL Interpark Tour” and “NOL Ticket.” According to Mobile Index, NOL’s monthly active users (MAU) in September totaled 5,602,848, ranking it first in the travel platform industry.