SOFT99corporation disclosed unauthorized access to its official online shop by a third party. The attack entered through the image-attachment function on the inquiry form, and an investigation is ongoing into the possible leakage of personal information belonging to members and purchasers. The number of affected people is reported as 136,968, but this has not been finalized.
Unauthorized access to SOFT99's official online shop was confirmed, and the incident was disclosed on 10 November 2026. On 5 November, the company was notified by the site's operating contractor of suspicious activity, and it was discovered that a program file had been uploaded through the function. The attacker allegedly used the upload as a foothold to install a file that accepted commands from outside, then used the site's operating privileges to investigate the server and read configuration files.
The disclosed information that may have been affected includes names, addresses, dates of birth, contact details, purchasing information, delivery addresses, the last 4 digits of card numbers, expiration dates and cardholder names. However, the release does not establish that full card numbers or security codes were leaked.
As a response, the online shop was temporarily suspended and the access route was blocked. The company plans to commission an investigation by external security specialists and implement measures to prevent a recurrence.
On 9 November, the incident was reported to the Personal Information Protection Commission. Additional official announcements and the results of the investigation are awaited.