Allegation: Actor Offers 12.1 Million CJ CGV Records for $250
A threat actor is advertising a database allegedly from CJ CGV, South Korea's largest cinema chain, with 12.1 million customer records, for $250 on a dark web forum. The claimed data includes user IDs, names, phone numbers, emails, physical addresses, booking history and payment amounts. CJ CGV has not confirmed an incident; the immediate risk is smishing and phishing impersonating the company.
What happened
A threat actor is offering an alleged database of 12.1 million CJ CGV customer records, South Korea's largest cinema chain, for $250 on a dark web forum. The data would include names, phone numbers, emails, addresses, booking history and payment amounts. CJ CGV has not confirmed an incident.
Why it matters
The low price could spread the data quickly if it is real. Customers would face SMS and email scams citing real cinema bookings and payments. There is still no confirmation of a breach.
What to do
Monitor CJ CGV statements and sources that confirm or deny the database. Warn teams and customers in South Korea about messages citing cinema bookings or payments. Track forums for samples and resale of the data.
For the technical team
- Affected
- CJ CGV, maior rede de cinemas da Coreia do Sul; base alegada de 12,1 milhões de registros de clientes oferecida por US$ · Alleged database of 12.1 million CJ CGV customer records. No product or version cited.
- Exploitation
- Unverified threat-actor claim reported by DailyDarkWeb. CJ CGV has not confirmed an incident. Not confirmation of a breach.
- Fix
- No fix applicable; alleged data leak incident.
- Vector
- Exfiltration method not described. DailyDarkWeb analyst notes the sample's booking and payment fields point to an export from a customer or ticketing database.
- More details
- Dark web forum listing asks $250. Claimed data: user IDs, full names, phone numbers, emails, physical addresses, booking history and status, gross and net amounts paid. Analyst assesses the low price raises the risk of smishing and phishing impersonating CGV.
Timeline
Incident opened.
Sources 1 source
- @DailyDarkWeb @DailyDarkWeb
