2026 GOPAX (Streami) — credential-stuffing logins; fewer than 10 accounts
Data compromised
Fewer than 10 customer accounts accessed abnormally; GOPAX reported no asset loss. FSC wave: names/contacts/RRNs/emails across the sector; no passwords or card numbers confirmed as stolen from this campaign. recordsAffected 10 is the stated upper bound.
Technical writeup
Verified via FSC/Chosun Biz 14 Oct 2026: Streami (GOPAX) among five newly named victims. Access via previously leaked credentials; <10 accounts; no asset damage. Distinct from a full exchange dump. companyConfirmed true; recordsAffected 10 (upper bound).
Root cause
Abnormal logins using previously leaked IDs/passwords (credential stuffing). GOPAX said it detected and blocked the attempts. Named by FSC among five newly confirmed 14 Oct victims in the 16-firm wave.