Kakao Pay denies alleged data leak of 40m users

A Kakao logo is shown on the company's headquarters in Pangyo, Gyeonggi Province. (Yonhap)

Kakao Pay, the mobile payments division of South Korea’s IT giant Kakao, has denied allegations of illegal customer data usage, amid revelations from a Financial Supervisory Service investigation.

On Tuesday, the FSS revealed that Kakao Pay had allegedly shared the credit information of approximately 40 million customers with third parties without their consent. The findings emerged from the agency’s recent inspection of Kakao Pay’s overseas payment services.

The FSS identified two primary issues with Kakao Pay’s data handling practices.

First, Kakao Pay is accused of providing personal data of users who had not consented to overseas payment services to Alipay. This occurred during the outsourcing of data processing for transactions on Apple's App Store to the Chinese fintech firm.

While only data of users using its overseas payment services should have been shared with Alipay, Kakao Pay reportedly provided extensive information on all its users, including usernames, phone numbers, email addresses, balances and transaction records. The FSS' discovery shows that about 54.2 billion pieces of personal data from roughly 40.45 million customers were leaked from April 2018 until recently.

Second, the FSS found that Kakao Pay improperly disclosed unnecessary credit data of overseas payment customers to Alipay. While only order details were needed for settling payments at foreign shops, Kakao Pay allegedly shared additional information, such as usernames and phone numbers. Since November 2019, approximately 550 million instances of such unnecessary data transfers have occurred.

"The FSS plans to conduct a thorough legal review and initiate sanctions while also investigating similar cases," the agency said Tuesday.

Earlier that day, Kakao Pay issued a statement refuting the allegations first reported by local media.

"We have not illegally shared customers' personal information. This was a standard procedure for delegating data processing required for payment services on Apple's App Store," the statement read, noting the firm has not yet received an official opinion from the FSS since the on-site inspection in May.

Following the FSS report, a Kakao Pay official declined to comment further and stated the investigation is still ongoing.

By Choi Ji-won(jwc@heraldcorp.com)