SecurityHeroblog
Security Basics11views

Like the Day You Lost Your Wallet — The Number You Can Reissue After the Lookpin Breach

Level13, the operator of the men's fashion app Lookpin, has admitted to a hack. Beyond the email addresses and phone numbers it first disclosed, addresses, refund account numbers, order histories, and even personal customs clearance codes for overseas direct purchases have been confirmed as leaked. We separate what cannot be changed from the number you can have reissued, and lay out what to do today.

Think back to the day you lost your wallet.

The first thing you do is call the card company and freeze the card. You get a new student ID, a new transit card. You start with the things you can have reissued.

But a wallet also holds things you can’t replace. Your name and your school printed on that student ID. The list of things you bought, printed on the receipts. Those can’t be issued again.

A few days later a message might arrive. “I found your wallet. To return it, please verify your identity at this link.” The sender knows your name and your school. Of course they do — they’re holding your wallet.

The incident reported this week resembles that scene. This article stays with the lost wallet all the way through.

First, the text message that could arrive on your phone

A message comes in. It has your name on it. It has the name of the clothes you bought last time. It says your shipment has been held at customs and asks you to re-verify your personal customs clearance code. You tap the link and a page dressed up as the Korea Customs Service appears. It asks you to enter your customs code and your bank account details.

The personal customs clearance code is a number the Korea Customs Service issues to individuals. It is used when goods you bought directly from an overseas store (overseas direct purchase) clear customs. We’ll call it the customs code for short.

FACT Level13, the operator of the men’s fashion app Lookpin, has admitted to a hack. It said that on September 16 there was abnormal external access to an internal data analytics system. It disclosed that in the course of that access, some customer information was taken.

FACT The company gave its first notice by email on September 20. At that point it listed four leaked items: email address, encrypted password, phone number, and access IP. An access IP is the address attached to a device when it connects to the internet.

FACT The list of leaked items the company has since confirmed has grown substantially. The newly added items are these:

  • Recipient name, address, and contact number
  • Refund account number
  • Masked card number (stored with part of the number hidden)
  • Order history
  • Personal customs clearance code
  • Year of birth, height, weight

The items that leaked differ from person to person. Not everyone had all of it taken.

FACT Lookpin urged users to be wary of texts and calls that use delivery, refunds, or compensation as a pretext. It told them not to tap links in messages, and to check through the official app or website instead.

INFERRED One thing needs to be made clear. The message described above is a message that could arrive. There is not yet any confirmation that fraudulent texts using the leaked data have actually been sent. There are no reports that any customs code has actually been misused. At this point the company has said “be careful.” What is confirmed is that the raw material for making such a message has gotten out. That is why we are writing this.

Put back in wallet terms: the wallet is already in someone else’s hands. The “I found your wallet” message hasn’t come yet. You still freeze the card now.

Why it works — because they’re holding the receipts too

INFERRED When we try to spot a fake message, we usually judge it this way. We look at how much the sender knows about us. If it just says “Dear customer,” we’re suspicious. If it has our name and the name of the clothes we bought, we believe it.

INFERRED Look at the leaked list again. Recipient name and address. Order history. Customs code and refund account number. Every ingredient needed for a single “held at customs” message is sitting in one wallet. So the reasoning “it knows this much detail, it must be real” does not hold this time. Knowing details is not evidence of being genuine. It can be a signal that someone is holding information that leaked.

INFERRED The timing overlaps too. It’s the Chuseok holiday period, when delivery notifications arrive more often than usual. One fake slipped in among the real delivery texts doesn’t stand out.

Messages like that are commonly called smishing — a compound of SMS and phishing (fraud that tricks you into handing over information).

FACT The path the data took has been explained this way. The company believes a security vulnerability in a data analytics tool called Metabase was exploited. Metabase is a program for pulling data accumulated inside a company into tables and graphs. A vulnerability is a gap in a program — a place that should have been closed but is open.

FACT Suspicious access was reported on August 29 and on September 15–16. It was reported that the company said it discovered an unknown account around 3 p.m. on September 16. It said it blocked access to that system the same day. The blocking date differs slightly between reports. Here we follow the company’s account: “blocked on the day it was discovered.”

FACT It was reported that Lookpin said it had filed a breach report with the Korea Internet & Security Agency (KISA) and a personal data leak report with the relevant authorities. It was also reported that CEO Kim Jong-hyun apologized for failing to protect customer information.

INFERRED Exactly how that gap was broken through is not covered in this article. What readers need is not the method. It’s what was in the wallet, and what has to be changed.

The scale, in numbers

Let’s put the numbers in a table. Please read the third column first. Who said it matters as much as the number itself.

Number What Who said it
2.7 million Number of customers claimed to be held Hacker’s claim · no company confirmation
11 million Number of orders claimed to be held Hacker’s claim · no company confirmation
September 18 The day a post selling Lookpin data appeared on a hacking forum Reported
September 20 The day the company first notified users by email Reported

FACT The 2.7 million and 11 million figures are the hacker’s words. A hacking forum is an internet message board where hackers buy and sell data. These are the numbers written in a sale post there. The company has not confirmed whether this data is genuine. And these numbers are not a victim count. The company has not yet disclosed how many people actually had information taken. It said it is still counting while filtering out duplicate accounts.

INFERRED Still, placing the two numbers side by side shows something. Divide 11 million by 2.7 million and you get roughly four orders per person. If the hacker is telling the truth, each wallet yielded not one receipt but a stack of them. It means a message listing several items of clothing you bought could be written.

FACT Look at the dates too. The sale post was reported as appearing on September 18. The company’s first notice was September 20. The sale post came two days before the notice.

INFERRED Which is to say: before you knew you’d lost the wallet, someone may already have put it on the market. That said, it has not been confirmed whether the data being sold is the same as the data from this incident.

FACT The day the company discovered the unknown account is September 16. Today is September 24. That’s day eight.

So, what to do now

The same order as the day you lost your wallet. First check what was in it. Then start changing the things you can have reissued.

One. Find out what left your wallet.

Use the breach lookup feature in the official Lookpin app or website. It was reported that after identity verification you can see which of your details were taken. What leaked differs from person to person, so be sure to check for yourself. If the results show a customs code or a refund account number, you need to go all the way to step three.

Two. Change your password. And everywhere else you used the same one.

What leaked here is an “encrypted password” — a value stored after being converted into an unreadable form. But how hard it is to unscramble that value has not been disclosed. When you don’t know, changing it is the right call. If you were using the same password on other sites, change it there too. If one card in your wallet was also a key to other doors, you have to change those locks as well.

Three. If your customs code leaked, get a new one.

In this incident, the customs code is the number that can be reissued, like a card. We confirmed that the Korea Customs Service e-commerce customs clearance portal has a code change menu.

One thing matters here. Do not go in through a link in a text message. Type the customs portal address into the address bar yourself. The address is listed in the sources at the end of this article.

While you’re there, look up your overseas direct purchase clearance records too. If there is a clearance record for an order you never placed, report it through the misuse report menu on the same portal.

Whether the old number stops working immediately once you get a new one is something we could not confirm. Neither could we confirm how many times a year you can change it. Follow the guidance on the portal’s own screens.

Four. Treat any text that sends you a link on the pretext of delivery, refunds, compensation, or customs as suspect from the start.

Even if your name is right and the name of the clothes you bought is right. Do not tap the link. If it’s about Lookpin, check in the official Lookpin app; if it’s about customs, check on the Korea Customs Service portal — go there yourself.

INFERRED Let’s close with the wallet. You can freeze a card and get a new one. In this incident, the password and the customs code are that card. But your name, your address, your height and weight, the list of clothes you bought — those cannot be reissued. So one more rule is needed. Do not follow the link from whoever contacted you first saying “I found your wallet.” You go to the lost and found yourself. How well the other side knows you is not the criterion. Who made contact first is.

What We Don’t Know

This blog does not write unconfirmed things as if they were confirmed. Here is what we still don’t know about this case.

  • We don’t know how many people actually had information taken. The company has not disclosed the scale, saying it is still counting while filtering out duplicate accounts.
  • We don’t know whether the data being sold on the hacking forum is the same as the data from this incident. The 2.7 million and 11 million figures are the hacker’s claim, and the company has not confirmed them.
  • We don’t know whether any customs code has actually been misused. No such case has been reported.
  • We don’t know whether fraudulent texts using the leaked information have actually been sent. At this point this is at the stage of concern and advisory, and there are no confirmed cases. The text-message scene in this article is something that could happen, not something that already has.
  • We don’t know whether the email addresses and encrypted passwords belong to all members or only some. The wording differs between reports.
  • We don’t know how the passwords were stored. Whether the method was easy to unscramble has not been disclosed.
  • We don’t know the compensation plan. Nothing has been reported.
  • We don’t know whether there is a limit on how many times a customs code can be reissued, or whether the old number stops immediately. We could not confirm this from primary sources.
  • We don’t know who did it. The perpetrator has not been reported. That is why this article contains no nationality and no organization name.
  • We were not able to see Lookpin’s original notice ourselves. We could not open the email or the in-app notice. We cross-checked reports from four outlets against each other to see whether they carried the same content.

Not confirmed: the original text of Lookpin’s notice, the actual number of people affected, the authenticity of the data being sold, whether fraudulent texts were actually sent, cases of customs code misuse, whether there is a limit on customs code reissuance and whether the old number is deactivated, the perpetrator. The blocking time differs slightly between reports, so we followed the company’s account (“blocked on the day of discovery”).

Sources

The primary sources are the breach notification Lookpin (Level13) sent to its users and the Korea Customs Service customs clearance portal. We could not verify the original text of the Lookpin notice, so we substitute the reports below.

This article is built from other outlets’ reporting, not from our own honeypot observations. That is why there are no attack timeline, MITRE, or IOC blocks. We did not fabricate data we don’t have. Attacker IPs and credentials were not in the brief either, so they are not included here — and therefore there is nothing to mask or quote. All facts are stated as of reporting from September 20–22, 2026. Because we could not directly verify the original company notice, anything carried by only one outlet is marked in the body as “it was reported.” The 2.7 million and 11 million figures are the hacker’s claim and are not a victim count. The perpetrator and their nationality have not been confirmed and are not stated. No reproducible commands, attack addresses, or procedures are included. Reference date 2026-09-24 · Published 2026-09-24.