Incident record
이십구센티미터
29CM (Musinsa) · E-commerce
This record separates what has been publicly claimed, investigated, and confirmed. It does not imply that every affected account belongs to a unique person.
Reported impact
159,852 records
Disclosure recorded
2026-08-30
Sector
E-commerce
Practical risk
High
What this means
A practical reading of this record
The public record supports a high practical risk level based on the currently reported scope and data categories. This can change if the organisation or regulator updates the record.
- Change the password for this service through its official app or website. Change it anywhere you reused it.
- Expect targeted phishing and account-recovery scams. Do not share verification codes with an unsolicited caller.
Classification
Categories are assigned only where the currently stored public record supports them. A privacy decision is not automatically treated as a hacking incident.
Evidence status
Why it appears in the index
Confirmed by the organisation, a regulator, or a documented official decision.
29CM reported 159,852 affected records. Payment data, IDs, and passwords were not reported as included.
Recorded source · 29CM disclosure and Korean media reporting
Direct source links are being standardised in the source archive. Until then, this page names the current evidence basis rather than substituting a generic link.
Editorial record
Review and status trail
Last reviewed
2026-09-21
The latest editorial review of the stored public record.
Latest source event
2026-08-30
The most recent dated event currently documented on this page.
Confirmed
Current status recorded from the first documented public event in this entry.
Documented events
Public timeline
- 01
Abnormal API access
29CM identified abnormal external access affecting an order-lookup integration feature.
- 02
Public notice
29CM published a notice describing the affected record count and data categories.
Data reported exposed
Protect your account
Change your password if you use this service
Use a new, unique password through the official app or website. Change any other account where you reused it, and enable a passkey or two-factor authentication when available.
Correction
Is something inaccurate or outdated?
Send a public source or official correction. Material updates are logged rather than silently replacing the record.