WHID 2008-10: Chinese hacker steals user information on 18 Million online shoppers at Auction.co.kr

Attack Information
WHID ID: 
2008-10
Date Occured: 
12 Feb 2008
Attack Method: 
Outcome Information
Outcome: 
Target Information
Attacked Entity Field: 
Retail
Attacked Entity Geography: 
Korea

Update (January 5th 2009)

We where informed by sources at eBay the Korean sites parent company that the issue was not CRSF or seesion hijacking. The attack method was not disclosed.


A Korean e-commerce site was hacked and a staggering number of record, 18 million, where stolen. In the US this would be front news. We don't know if it was front news in Korea, but did not get to the international media.

The attack description is vague but can be best described as session hijacking.

This incident is a great example of the lack of sufficient international coverage at WHID. Help us by sending us non English incidents! After all, it is not English speakers only that get hacked, but rather us, the WHID maintainers that speak only this language.

More Information: