Incident record
씨제이올리브영
CJ Olive Young · Retail
This record separates what has been publicly claimed, investigated, and confirmed. It does not imply that every affected account belongs to a unique person.
Reported impact
~4,900 successful logins
Disclosure recorded
2025-03-21
Sector
Retail
Practical risk
High
What this means
A practical reading of this record
The public record supports a high practical risk level based on the currently reported scope and data categories. This can change if the organisation or regulator updates the record.
- Follow the organisation’s official notice, use a unique password, and be cautious of follow-up messages using details from the incident.
Classification
Categories are assigned only where the currently stored public record supports them. A privacy decision is not automatically treated as a hacking incident.
Evidence status
Why it appears in the index
Confirmed by the organisation, a regulator, or a documented official decision.
Reported impact refers to successful logins, not necessarily unique people or confirmed downloads of every listed data field.
Recorded source · CJ Olive Young disclosure and Korean media reporting
Direct source links are being standardised in the source archive. Until then, this page names the current evidence basis rather than substituting a generic link.
Editorial record
Review and status trail
Last reviewed
2026-09-21
The latest editorial review of the stored public record.
Latest source event
2025-03-21
The most recent dated event currently documented on this page.
Confirmed
Current status recorded from the first documented public event in this entry.
Documented events
Public timeline
- 01
Credential-stuffing attack began
The reported attack targeted customer accounts using a large volume of login attempts.
- 02
Incident reported
The company and Korean media reported successful logins and possible account-profile exposure.
Data reported exposed
Protect your account
Change your password if you use this service
Use a new, unique password through the official app or website. Change any other account where you reused it, and enable a passkey or two-factor authentication when available.
Correction
Is something inaccurate or outdated?
Send a public source or official correction. Material updates are logged rather than silently replacing the record.