[Notice] Personal Information Breach and Our Apology

We sincerely apologize to all ONDA customers.

We have confirmed that, between October 12 and 13, 2026, some reservation information in our reservation management system (HotelPlus) was viewed without authorization due to abnormal external access to the system's API. Upon becoming aware of the incident on October 14, we immediately began an emergency response.

Based on our investigation so far, we estimate that 24,777 reservation records may have been affected, and we are continuing to verify the exact scope and impact. The information potentially exposed includes name, mobile phone number, and reservation details (reservation number, reservation status, accommodation information). We have confirmed that payment card information was not affected.

After detecting the incident, we blocked the attacker's IP addresses and the abnormal data access paths, and took emergency security measures on the affected system. We have also strengthened authentication and access control, as well as tracking and audit logging, and are continuously monitoring our systems. We are investigating the cause and scope of the incident in cooperation with the Korea Internet & Security Agency (KISA), other relevant authorities, and external security experts. We have also reported the incident to the Cyber Investigation Division of the Seoul Metropolitan Police Agency and are fully cooperating with the ongoing investigation.

To date, our Customer Center has received 277 related inquiries and reports, and no actual financial losses from additional payment requests or smishing have been confirmed. However, please be especially cautious of messages via WhatsApp or other messaging apps from anyone impersonating ONDA or our partner properties and asking you to confirm a reservation, make an additional payment, or enter personal or card information.

ONDA does not request additional payments via WhatsApp or other messaging apps between booking and check-in. In particular, if someone mentions your name, reservation number, or stay dates and asks for additional payment or card details, do not respond, and do not click links in suspicious texts or chat messages. Please always verify reservation details through the official website of the platform or property you booked with, or by contacting the ONDA Customer Center. Although passwords were not among the information potentially exposed, we recommend changing your password for account security.

We are taking necessary protective measures, including receiving damage reports, investigating the facts, and preventing further harm. If actual damage is confirmed, we will carefully review the facts and the damage incurred and do our utmost to provide appropriate relief and support. For inquiries or to report damage, please contact the ONDA Customer Center (+82-1544-3812, abuse@onda.me). You may also seek relief by applying for mediation through the Personal Information Dispute Mediation Committee (https://kopico.go.kr, +82-1833-6972), or by filing a claim for damages or statutory damages under applicable law.

We take this incident very seriously and will focus all our efforts on identifying the exact cause, preventing further harm, strengthening our security, and preventing recurrence. Once we have confirmed whether and to what extent information was exposed, we will provide further updates without delay.

Once again, we deeply and sincerely apologize for the concern this has caused our customers.

ONDA Co., Ltd.