PFCT review: P2P Lender Security After 2026 Data Breaches
In short
PFCT and Mouda suffered separate cyberattacks on September 27, 2026, exposing personal data of over 19,000 individuals through server vulnerabilities.
PFCT, formerly known as PeopleFund, suffered a data breach on September 27, 2026, that exposed limited personal information of approximately 314 individuals. The incident occurred alongside a larger attack on Mouda, another South Korean P2P lending firm, which affected roughly 18,900 people. Together the events marked early targets in a wider wave of financial-sector intrusions that day.
Attackers used a server-side template injection flaw in PFCT's investment service to reach administrator functions. The compromised data included names, resident registration numbers, and phone numbers, but no loan details or account credentials. PFCT detected the activity the same morning and notified regulators the following day.
Technical Details of the PFCT and Mouda Incidents
The PFCT breach took place between 3:29 a.m. and 4:34 a.m. local time. Investigators identified the entry point as an unpatched server-side template injection vulnerability that granted elevated privileges. No evidence emerged of further movement into loan systems or fund transfers.
Mouda's compromise occurred around 11:54 a.m. through a web application weakness exploited via traffic from multiple IP addresses. That incident exposed names, mobile numbers, and credit-related fields such as KCB scores and income data for applicants of easy-loan products. Both firms confirmed signs of intrusion on September 28 and filed reports with the Personal Information Protection Commission and KISA shortly afterward.
These P2P attacks preceded similar incidents at several banks later the same evening. Overlapping attack infrastructure noted by authorities suggests possible coordination, though final attribution remains under review. The combined exposure across roughly 16 financial institutions reached an estimated 100,000 records by mid-October.
Regulatory Actions and User Implications
South Korea's Financial Services Commission and Financial Supervisory Service convened emergency meetings with the Online Investment-Linked Finance Association between October 4 and 6. Regulators shared known malicious IP addresses and directed affected platforms to conduct security self-assessments. Investigations continue into connections between the P2P cases and later bank breaches.
Users of PFCT and Mouda received notification obligations under the Specialized Credit Finance Business Act. Both platforms stated they would cover costs related to identity protection measures. No confirmed cases of account takeovers or financial losses tied directly to the September 27 incidents have been reported as of October 21.
Practical steps for affected individuals include monitoring credit reports for unusual activity, enabling two-factor authentication on linked accounts, and contacting the firms for specific remediation offers. P2P platform security reviews now emphasize regular vulnerability scanning and prompt patching of web application flaws.
| Firm | Records Exposed | Primary Data Types | Attack Vector | Detection Date |
|---|---|---|---|---|
| PFCT | ~314 | Names, RRNs, phones | SSTI vulnerability | September 27 |
| Mouda | ~18,900 | Names, mobiles, credit scores, income | Web application flaw | September 28 |
Frequently asked questions
What data was exposed in the PFCT breach?
Names, resident registration numbers, and phone numbers of about 314 individuals were accessed through an administrator function. Loan records and account credentials remained unaffected.
How did the Mouda attack differ from PFCT?
Mouda's breach exposed credit and income details for nearly 19,000 applicants via a web vulnerability, while PFCT's exposure stayed limited to basic contact fields through a server template flaw.
Have regulators taken action after these incidents?
The Financial Services Commission and Financial Supervisory Service held meetings in early October, shared threat indicators, and required security reviews across the sector. Investigations into links with later bank breaches remain ongoing.
Should users close accounts at PFCT or Mouda?
No directive from regulators recommends account closure. Both firms have stated they will provide identity protection support, and no fund access occurred during the attacks.
TrustScope
Comments 1