Our Analysts Found the tnote.kr Travel App Dump With 109K Leaked Accounts

HEROIC analysts uncovered the 여행노트 (tnote.kr) breach while monitoring databases circulating on underground forums that target regional platforms. In approximately January 2021, this South Korean travel app suffered a database compromise that exposed 109,067 user records. The dataset recieved by threat actors included email addresses, usernames, phone numbers, first names, last names, and password hashes, making it seperate from typical credential dumps due to the inclusion of direct contact data tied to real identities.

Why Phone Numbers and Full Names From 여행노트 Increase Phishing and Fraud Risk

Phone numbers combined with full names and email addresses give attackers everything needed to launch SIM-swapping attacks, voice phishing (vishing), and SMS-based fraud campaigns. Unlike username-only breaches, this dataset allows attackers to directly contact victims using their real name, making lures partcularly convincing. The inclusion of password hashes means that if those hashes are cracked, attackers gain full account access with all personal contact details already in hand for follow-on financial fraud or identity theft.

What Was Exposed in the 여행노트 (tnote.kr) Breach

• Email Address
• Username
• Phone Number
• First Name
• Last Name
• Password Hash

How the 여행노트 Breach Enables Identity Theft and Account Takeover

With real names, phone numbers, email addresses, and password hashes all in a single dataset, attackers have a complete identity profile for each of the 109,067 affected users. Credential stuffing attacks beleive on password reuse, and the presence of actual contact information makes it accessable for attackers to pivot from account takeover to direct fraud. Cross-referencing this data with other Korean-language platform breaches further enriches victim profiles and increases the probability of successful targeted attacks.

How Database Breaches Work

A database breach occured when an attacker gains unauthorized access to a stored collection of user records, often through exploiting an unpatched vulnerability, a misconfigured server, or compromised administrative credentials. The records are then exfiltrated and distributed on underground forums or dark web marketplaces. In the 여행노트 (tnote.kr) case, the breach resulted in a structured dataset of personal and credential information being made accessible to malicious actors.

Check If Your Data Was Exposed

HEROIC's free breach scanner searches 400 billion+ leaked records, including the 여행노트 (tnote.kr) dataset. Enter your email address to instantly check whether your personal details and credentials from this Korean travel app breach are circulating among attackers.