SecurityHeroblog
Security Basics13views

A Scam Script With the Blanks Filled In — The Call That Comes After a Math Academy Breach

It was reported that the test-reservation site of 'Thinking Bull' (생각하는황소), a math academy with branches nationwide including Daechi-dong, was breached and that student names, schools, grades, dates of birth, and parents' phone numbers may have leaked. Here is what to do when someone holding that information calls to say 'your child has been hurt' — and what has not yet been confirmed.

You’ve probably received a text like this on your phone: “Happy birthday, ○○○! Here’s a special coupon just for you.” It’s a message where only the name slot has been swapped for yours. Everything else is identical no matter who receives it. That’s why nobody falls for it. There’s only one blank, and the fact that my name is in that blank doesn’t mean the sender knows me.

But what if there were five blanks? My child’s name. The school my child attends. Their grade. Their date of birth. And my phone number. The call comes with all five blanks filled in correctly. “Is this ○○’s mother? ○○, third grade at ○○ Elementary, was hurt on the way to the academy.”

This post is about where those blanks got filled in, and why — even when every blank is correct — you must not trust that call. We’ll carry the fill-in-the-blanks idea all the way to the end.

First, What Could Happen on My End

A call comes from an unknown number. The caller says your child’s name. The school and grade are right, too. And then they say: there was a collision on the way to the academy. Your child is hurt and has to go to the hospital now. Or: we have your child.

Parents freeze on the spot. They send money wherever the caller tells them to, or they tap the link in the text that follows. Because someone who knows your child’s name and school exactly couldn’t possibly be lying, you think. But as of this week, the premise behind that thought is shaking.

FACT On September 17, an unidentified person broke into the test-reservation site of the math academy Thinking Bull (생각하는황소), Money Today reported. The academy posted a notice about it on its website the next day, the 18th. The test-reservation site is where students who want to enter the academy book dates for entrance exams or level tests. So the information on that site is, in effect, “the information of children and parents who have booked a test at some point.”

FACT The information believed to have leaked is student names, schools, grades, dates of birth, and parents’ names and phone numbers, Boan News reported. The Personal Information Protection Commission determined that sensitive information such as grades or payment details was not included, Asia Economy reported. The Personal Information Protection Commission is the government body that oversees personal data breaches. “Sensitive information” is a separate term for data that causes especially serious harm when it leaks.

FACT After the breach notice, posts saying they had received calls like these began appearing in online communities where parents gather, Boan News reported. A call demanding compensation because there was an accident on the way to the academy. A claim that the child was hurt and had to go to the hospital. A text saying they have the child.

INFERRED Let’s draw a line here. Whether those calls posted in the communities were actually made using the information from this breach has not been confirmed. This post goes only as far as “calls like this could come.” But the fact that the material to fill in the blanks of that script may have leaked has been reported, and that’s why we’re writing this now.

Why It Works — When the Blanks Are Filled, Someone Else’s Script Becomes “My Problem”

INFERRED The “your child has been hurt” script is the same no matter who it’s aimed at. Only the blanks change. When the blanks are empty, the script doesn’t work very well. If someone says “your child has been hurt,” you ask back, “Who? Which school?” In that one beat of asking back, doubt gets in.

INFERRED When the blanks are filled, that beat disappears. When the child’s name, school, and grade come out exactly right, the body moves before the head does. You send money or tap the link with no gap to check. That “no gap” is exactly what the scammer wants. The items reported as possibly leaked this time are precisely those blanks.

FACT The academy issued this warning, Asia Economy reported: if you receive contact or messages from someone you don’t know, assume it may be voice phishing, and refrain from giving out personal information or tapping links. Voice phishing is a scam that fabricates an urgent situation over the phone to extract money or information. When the same thing is done through a link in a text message, it’s called smishing.

FACT The academy temporarily shut down the site and reported the incident to the relevant authorities, according to reports. “Relevant authorities” is a catch-all term for the government agencies responsible for handling such incidents. The academy is in the process of notifying affected parents by text message and is preparing materials to request a police investigation.

INFERRED How the intruder got in has not been reported. This post does not speculate about the method. What parents need to know is not how the site was breached, but which blanks got filled in and, therefore, which calls to screen out.

The Scale in Numbers

This case has few numbers. In particular, no report says how many people’s information leaked. So we did not invent a number to fill the gap. Please look at the second column.

Number What Source
About 70 Number of Thinking Bull branches nationwide Boan News (reported)
September 17 Date of the test-reservation site intrusion Money Today (reported)
September 18 Date of the academy’s website notice Money Today (reported)
(none) Number of students and parents affected Not in any report

FACT About 70 branches. This is not just a matter for one academy in Daechi-dong. Anyone who has ever booked this academy’s test at any branch nationwide could be affected. The academy stated that, because the hacker had informed them they were in the process of securing all the data, it was highly likely that the information of every parent and student with a reservation history had leaked, according to reports. But “every” is the academy’s own estimate, and how many people that is appears nowhere.

FACT Intrusion on the 17th, notice on the 18th. One day apart. And the reports dated the 18th already mentioned the phishing-call posts in the communities. That means the blanks in the script could have been filled in between the time a child left for school and came home.

INFERRED So the response is not “I’ll be careful later.” It’s today. A script with the blanks filled in gets used from the day it’s made. Today is the day after the notice came out.

So, What to Do Now

Two things. Both can be done today, and neither costs money.

One. If a call says your child has been hurt or was in an accident, hang up and make the call yourself.

It doesn’t matter whether the caller knows your child’s name, recites the school and grade, or claims to be from the academy, a hospital, or the police. Hang up first. Then call your child directly. If your child doesn’t answer, call the school, then the academy’s main number. The key is that you dial a number you already knew, and you dial it yourself. A number the caller gave you doesn’t count. If your child really was hurt, this check takes one phone call, and if it’s a scam, it falls apart right here.

In fill-in-the-blanks terms: all the blanks being filled in correctly means the caller has that script in hand, not that the caller is genuine. Whether it’s genuine can only be confirmed by the one call you make yourself.

Two. Don’t tap links in texts that come in the name of the academy or an agency.

The academy is reported to be notifying affected parties by text. If you received that text, think of it this way from now on: my child’s blanks may already be filled in. So assume any unfamiliar contact from here on could be a scam. In particular, if it tells you to tap a link in the text, install an app, enter personal information, or send money, stop right there. The academy itself has already asked people not to tap links.

INFERRED Boiled down to one line, the two points are this: filled-in blanks are not grounds for trust. Only the call you make yourself is. You can say this line to an elementary-school child, and you can say it to grandparents. Either of them could be the one who picks up the phone.

What We Don’t Know

This blog does not write about unconfirmed things as though they were confirmed. Here is what is still unknown in this case.

  • We don’t know how many people’s data leaked. No report gives a figure. “Everyone” is the academy’s own estimate, and this post recorded it as an estimate, nothing more.
  • We don’t know whether the accident- and kidnapping-pretext calls posted in the communities used the information from this breach. The connection has not been confirmed. Only one outlet, Boan News, carried that report. That’s why the phone-call scene in this post is something that “could happen,” not something that “happened because of this breach.”
  • We don’t know who did it, or why. Whether the hacker demanded money, or where the data was published or sold, has not been reported. That’s why this post names no nationality and no group.
  • We don’t know how they got in. There are no reports on the intrusion path or what weakness was involved.
  • We could not see the academy’s original notice directly. The notice page on the academy’s website was inaccessible. Everything in this post about the notice is based on what the press quoted from it.

Unconfirmed: the number of people affected, the connection between the community phishing-call reports and this breach, whether the hacker made demands and whether the data was distributed, the intrusion path, and the original text of the academy’s notice. The facts in this post were cross-checked across three outlets — Boan News, Money Today, and Asia Economy — and the intrusion date, notice date, list of items believed leaked, and the academy’s warning matched. The phishing-call reports were carried by Boan News alone.

Sources

The primary source is the breach notice on the Thinking Bull website. Access was blocked and the original could not be verified, so the reports below that quoted it are used instead.

This post is written from other people’s reporting, not from our own observations. That is why there are no attack timeline, MITRE, or IOC blocks, and no IP addresses to mask or credential material to quote — we do not fabricate material that does not exist. All facts are based on reports that relayed the academy’s notice of September 18, 2026, and because we could not verify the original notice directly, the body text marks them with “reported.” The number of people affected was not reported, and the connection between the community phishing calls and this breach has not been confirmed. The attacker, cause, and nationality have not been confirmed, so they are not stated. No commands, addresses, or procedures that could be replicated are included. Observed and published 2026-09-19.