1.66 million accounts. One reused-password problem.

The GS Retail case is a reminder that a breach does not always begin with a dramatic break-in. Sometimes attackers simply try passwords that have already leaked somewhere else.

The attack was ordinary. The scale was not.

In an August 2026 decision, South Korea’s Personal Information Protection Commission (PIPC) said attackers repeatedly used stolen ID-and-password pairs against GS SHOP and GS25 accounts. That technique has a plain name: credential stuffing.

The PIPC found that 1,581,026 GS SHOP users and 79,128 GS25 users were affected. The lesson is uncomfortable because it is familiar: a password reused from an unrelated service can become a key to a retail account that was never directly hacked.

The warning signs were in the login traffic.

The regulator said GS Retail did not adequately detect unusual login volume and failure patterns. It also found that the company became aware of the GS25 incident in January 2025 but did not take sufficient follow-up action before a later GS SHOP incident.

This is the part that matters beyond one retailer. Credentials alone may be stolen elsewhere, but detection, rate limits, and an effective response decide whether a replay attack turns into a long-running exposure.

What users can actually do.

If you used GS25 or GS SHOP, change the password if it was ever reused. Do not wait for a suspicious notification. A password manager is useful precisely because it makes a different password for every service practical.

Then turn on the strongest sign-in protection the service offers. Two-factor authentication or passkeys reduce the value of an old password circulating in another breach database.