Park Jae-hyuk is a seasoned journalist who has provided comprehensive coverage of South Korea's corporate dynamics, economic policies, industry challenges and the global positioning of Korean companies. Based on the articles he has written since joining The Korea Times in 2016, his investigative approach has helped readers understand corporate governance, economic trends and business strategies shaping South Korea’s economy.
TMON users hit by cyberattack again
By Park Jae-hyuk
TMON has been in the hot seat since a group of shoppers using its online payment system fell prey to a cyberattack amid growing concerns over the e-commerce firm's cybersecurity, according to industry officials Monday.
The users claim someone had logged in on their TMON accounts and purchased gift certificates worth hundreds of thousands of won with the simple payment system linked with their bank accounts.
“As I trusted TMON, I entrusted my bank account information to the company. However, it said I should personally report the identity theft to the police. The company said it would cooperate with the police, only if the police ask for cooperation,” said a TMON Pay user, who claimed to have had 300,000 won ($265) stolen. “When I asked TMON about compensation for the loss, the company said it would discuss the matter internally.”
The victims urged TMON to make an apology and compensate them for their losses, but the online shopping platform provider denied its responsibility, saying, “It was online theft, not a cyberattack.”
An ad for TMON Pay says payment can be done in three seconds with the e-commerce firm's simple payment system. / Courtesy of TMON
By Park Jae-hyuk
It was not the first time TMON has been mired in a cybersecurity scandal.
According to industry officials, the police investigated an identity theft case involving TMON Pay in June.
In 2016, 66 users of TMON Pay lost 37.5 million won, after the PIN numbers of their gift certificates were leaked.
Experts blame TMON's identification system for the series of identity thefts.
According to the experts, TMON users can change their passwords for TMON Pay with another person's mobile phone number, because they can register the phone number without additional identification.
This means anyone can change payment passwords, if they know a TMON user's ID and password.
Considering the IDs and passwords of most Koreans have been leaked to hackers through various information security breaches, TMON Pay's identification system can be regarded as much riskier than that of its rivals, such as Coupang and WeMakePrice.
Those two firms ban their users from changing payment passwords with another person's mobile phone number.
Other online shopping platforms, such as Gmarket, Auction and 11st, allow users to change payment passwords, only if the users identify themselves with their own mobile phones.
Amid the growing criticism, TMON vowed to improve TMON Pay's security.
After a temporary suspension of service over the weekend, however, TMON resumed service for its TMON Day discount event held Monday, drawing harsher criticism.