Korean Fashion Platform 29CM Leaks 159,000 Customer Records in API Security Breach

The Quick Take

• Fashion platform 29CM confirmed a data breach on August 27 that exposed approximately 159,852 customer records through unauthorized external access to an order-inquiry API.
• 21,011 records included full contact and delivery address details; 138,841 records exposed names only.
• Parent company Musinsa blocked the breach immediately and self-reported to Korea Internet Safety Agency KISA.
• Payment information, account IDs, and passwords were confirmed not included in the leaked data.

The 29CM breach adds to a growing list of API-related security incidents at South Korean consumer platforms, exposing systemic vulnerabilities in how order inquiry systems are secured against unauthorized external access. Musinsa, which operates 29CM as part of its fashion e-commerce portfolio, faces immediate regulatory scrutiny under Korea's Personal Information Protection Act, which mandates breach notification and can impose fines proportional to affected records. With nearly 160,000 records exposed, the financial exposure to regulatory penalties and potential class action litigation is non-trivial for a company navigating an anticipated IPO timeline.

The market implications extend beyond 29CM itself. Musinsa is Korea's largest domestic fashion e-commerce operator, and any erosion of consumer trust could accelerate customer churn toward rivals including Kakao Style, Naver Shopping, and international players. The breach may also trigger mandatory security audits of other Musinsa-operated platforms, creating near-term compliance costs. E-commerce platforms with Korean listings and investors tracking Musinsa's IPO valuation will watch closely for signs that reputational damage is affecting user engagement metrics in coming weeks.

Forward signals to watch include the KISA investigation timeline and any formal penalty assessment under PIPA enforcement guidelines. Civil litigation from affected consumers could create multi-year liability risk and set precedents for damages in Korean data breach cases. Musinsa's response—including a 30-day customer notification portal—reflects awareness of reputational stakes. Security technology vendors serving Korean e-commerce are likely to see increased procurement interest as platforms rush to audit their API security postures following this high-profile breach at a major operator.

Synthesized from 3 sources.