[E-Daily Reporter Shin Yeong-bin ] A hacking incident occurred on “Dooray!”, the business collaboration service provided by NHN(181710), resulting in the leak of business data and personal information of employees from some client companies.

NHN Dooray announced on the 14th via a notice on its website that a security breach caused by an external party had occurred in some client accounts and that it had confirmed the leakage of business data and personal information.

Dooray! is a cloud-based business collaboration platform operated by NHN Dooray. It is used not only by private companies but also by government ministries and public institutions, and was recently utilized in the development of “Gukbang I-eum,” a defense collaboration platform used by approximately 300,000 military personnel across all branches.

NHN Dooray has filed reports regarding the security breach and the personal information leak with the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission, respectively. It has also notified the affected client companies and individual account holders of the details of the incident.

The incident occurred between approximately 10:00 p.m. on the 12th and the early morning hours of the 13th.

The attacker repeatedly entered verification codes during the password recovery process to change the passwords of some accounts and then logged in without authorization. Due to a security vulnerability in Durey’s open API, some authentication keys were leaked, and API calls by unauthorized third parties exploiting this vulnerability were confirmed.

The compromised data included work-related content stored in some client companies’ projects, drives, messengers, and calendars. It was also determined that the IDs, names, external email addresses, phone numbers, departments, job titles, positions, and company names of client company employees were leaked.

Immediately after confirming the incident, NHN Durey blocked the IP addresses used in the attack and strengthened the password reset verification process. It also revoked all existing service API and administrator API keys and suspended related functions.

NHN Durey immediately changed the passwords for affected accounts and recommended that other users also change their passwords and set up two-factor authentication. The company also urged users to be vigilant against secondary damage, such as phishing and smishing, that could result from the misuse of leaked email addresses or phone numbers.

An NHN Durey spokesperson stated, “To date, we have confirmed that business-related data—including emails and messages from some client companies—as well as personal information such as employee IDs, names, and contact information have been leaked,” adding, “We will actively cooperate with the investigations by relevant authorities and do our utmost to identify the cause of the incident, prevent its recurrence, and devise measures to restore our clients’ data.”