Two hacks, one week, the same way in
Nol Universe, the South Korean travel platform run by Yanolja, admitted on 26 October 2026 that hacking had exposed personal information belonging to some of its customers and employees. The company apologised and said it was strengthening its security system. What makes this disclosure unusual is that it covers not one intrusion but two, three days apart, and both went through the same kind of door: a lookup function, reached by an external attacker exploiting a system vulnerability to gain what the company calls abnormal access.
The first intrusion hit a staff lookup function on 19 October. The second hit a customer booking lookup on 22 October at 02:05. Nol Universe disclosed the staff incident in a homepage notice on 22 October, and the customer incident in a further notice on 26 October, after a follow-up investigation widened what it had first found. The company has not said the two incidents are linked, and the shared method alone does not prove a single campaign. But the pattern, two lookup functions in one week, is the detail that separates this breach from a routine single-system exposure.
What customers lost, and what they did not
The customer incident concerns domestic accommodation bookings made through the old Interpark Tour service. The affected customers are those who used that service for bookings dated 15 February to 8 September 2026. The exposed fields, as stated in the company notice, are member ID, member number, reserver name, user name, phone number, email address, product name, purchase amount, and usage date. In plain terms, that is booking-commercial information plus contact details: what was booked, what it cost, when it was for, and how to reach the person who booked it.
The notice is equally specific about what is not in scope. Flight bookings, overseas accommodation bookings, tour bookings, ticket bookings, and NOL service bookings are all explicitly excluded from this customer incident. No payment card data, bank account data, or resident registration number exposure is stated in the reports of the notice, and no such claim should be read into it.
The staff side is the more sensitive half
The staff incident, on 19 October, exposed a different set of fields: names, phone numbers, company emails, employee numbers, and an encrypted internal-system access password. Partner company staff were also among those confirmed exposed in the initial round. The staff side carries the sharper security risk, because it includes a credential, even one described as encrypted. An encrypted password is not a plaintext password, and the reports do not claim otherwise, but it is still an internal-system credential, and that makes the staff half of this breach the one to watch most closely.
The count started at two, then grew, and still has no total
Here the numbers need care, because the easiest misreading of this story is also the most likely one. After first confirming exposure for 2 users plus some employees and partner staff, Nol Universe blocked the access path, reported to the relevant authorities, and notified the people affected. A follow-up investigation then found additional exposure among some old Interpark Tour accommodation customers, which it reported to the authorities and notified individually. Hankyung states explicitly that the notice and the statement contain no specific victim headcount or damage scale. The figure of 2 is the initial round only. It is not a total, it is not an estimate, and it must not be used as either. As of the 26 October disclosure, no confirmed total exists for customers or for staff.
What Nol Universe has done so far
On learning of each incident, the company says it immediately blocked the access path used in the attack, patched the vulnerability, and strengthened its system for detecting and blocking abnormal access. It has applied to the Korea Internet and Security Agency, KISA, for technical support, and it says it is cooperating with the relevant authorities. For vulnerability remediation, it has temporarily suspended the service for viewing pre-23 October reservation history in the old NOL Interpark Tour accommodation section, so customers cannot currently check those reservations directly, and it says it will restore the lookup function promptly. It has also warned users to beware of suspicious contact by email, text message, or phone in connection with this incident, and not to open unclear-source links or enter personal or authentication information through them. No compensation, refund, or free-service offer is announced in the reports of the notices, and no service outage beyond the reservation-history suspension is stated.
The timeline, reconstructed (TechReview analysis)
Putting the company dates together gives a timeline worth stating plainly, because the disclosure lags are part of the story. The staff incident on 19 October reached its first notice on 22 October, a gap of three days. The customer incident on 22 October reached its customer notice on 26 October, a gap of four days, and the customer set was disclosed only after the follow-up investigation widened the initial finding. The booking-exposure window runs from 15 February to 8 September 2026, 205 days elapsed between those dates. That window describes which bookings fall in scope. It does not mean every booking in that window was accessed, and the company has not said so. Converting 205 days into a victim number would be inventing a figure the company has not given.
What to watch next
Nol Universe says it is still identifying the intrusion route and scope, and that it will announce newly confirmed matters promptly as it continues checking for further harm. For readers who booked through the old Interpark Tour service in the affected window, the practical step for now is the company’s own warning: treat unexpected contact with suspicion, and use official channels rather than links in messages. Three things will decide how this story develops. First, whether a confirmed victim total ever appears, for customers or for staff. Second, whether the company says anything more about how the two lookup functions were reached, and whether it links the two incidents or treats them as separate. Third, whether the suspended reservation-history lookup returns, and on what terms. Until then, the confirmed picture is narrow but clear: two lookup intrusions in one week, booking details and staff records exposed, no total, no attacker identified, no ransom demand reported, and an investigation still open.
Sources
- Yonhap News Agency, 26 October 2026: Nol Universe data breach disclosure (Korean)
- Hankyung (The Korea Economic Daily), 26 October 2026: Nol Universe data breach disclosure (Korean)
