Seoul bike-share Ddareungi to compensate 4.62 million data-breach victims with 30-day passes

The Seoul Facilities Corporation announced Tuesday that it will give 30-day passes to about 4.62 million Ddareungi bike-share members whose personal data was leaked in a 2024 breach.

The corporation will provide each affected member with a 30-day Ddareungi pass — a one-hour-per-ride coupon valued at 5,000 won ($3.40). The Seoul Metropolitan Government amended its bicycle-use promotion ordinance in April to allow such compensation for personal data leaks.

The coupons will be distributed through the Ddareungi app in August and must be used within three months of issuance. Members who already hold a valid pass may use the coupon within three months after their current pass expires.

According to the Seoul Metropolitan Police Agency's cyber investigation unit, about 4.62 million subscriber accounts were leaked from the Ddareungi server over two days beginning June 28, 2024. The compromised data included user IDs, mobile phone numbers, email addresses, home addresses, dates of birth, gender and body weight. Names and resident registration numbers were not included. Police referred two high school students — identified only as A and B, the latter of whom was a middle school student at the time of the offense — to prosecutors without detention on charges of violating the Act on Promotion of Information and Communications Network Utilization and Information Protection. Prosecutors have since asked police to conduct a supplementary investigation.

No evidence has emerged that the leaked data was passed to third parties. The corporation, which has been accepting breach-related damage reports, said it has received zero such reports since the incident.

However, individuals whose data was leaked may seek damages under Article 39-2 of the Personal Information Protection Act even without proving actual harm — the mere fact of a leak is sufficient grounds for a claim. The Seoul Metropolitan Government's decision to compensate residents through the ordinance amendment is based on the same provision, which allows data subjects to claim up to 3 million won without demonstrating actual damages when a data controller loses, has stolen, leaks, forges, alters or destroys personal information through intent or negligence.

The corporation, after consulting with the Korean National Police Agency and the Personal Information Protection Commission, has finalized the specific data items leaked for each individual and will begin sending individual MMS notifications and posting guidance on its website to about 4.62 million affected residents starting Tuesday. The notifications will detail each person's specific leaked items — which may include user ID, mobile phone number, date of birth, gender, body weight, email address, postal code, home address, and a guardian's mobile phone number, date of birth and gender — along with an explanation of how the breach occurred and tips for preventing harm. The exact items disclosed vary by member depending on when and how they registered.

About 1.2 million messages will be sent per day on a rolling basis. Users who have changed their phone number or opted out of text messages may not receive the notification; they can confirm their leaked items by contacting the call center or by email.

The corporation said no cases of the leaked data being further distributed to third parties or causing secondary harm have been confirmed since the incident in June 2024. It added that it is cooperating with relevant authorities in their investigation and verification procedures and will promptly notify users if additional facts come to light.

Han Kook-young, president of the Seoul Facilities Corporation, apologized for the incident. "I sincerely apologize again for the concern and inconvenience this personal data breach has caused our citizens," he said. "We will completely overhaul our security systems and work closely with relevant agencies to do everything in our power to ensure that citizens can use Ddareungi with confidence."