Samsung discloses website breach after some users see strangers' data and says an unrelated glitch caused push notifications to users from Find My Mobile app
Tight-lipped chaebol still won't talk about the dodgy app, though — Samsung has admitted that what it calls a “small number” …
Context & Ripple Effects
This is not Samsung's first web-property data exposure: less than a year earlier, [[a:943848|Sprint disclosed that hackers had reached its customers' names, billing and device details through Samsung's own website]], with no count of those affected. Now Samsung has confirmed some users were shown strangers' data on the same property, while separately blaming an unrelated glitch for stray Find My Mobile push notifications — and staying silent on the app itself.
The silence matters because the pattern keeps repeating: two years later Samsung would confirm internal source code leaked by the Lapsus$ group and then admit hackers stole customer contact data from its US systems in a late-July 2022 breach. Each disclosure arrives only after users or outsiders surface the problem first.
First-order effects
- A 'small number' of Samsung account holders have been able to view other people's personal data on Samsung's website, and Samsung has given them no scope, cause, or remediation detail beyond that phrase.
- Find My Mobile users received push notifications apparently meant for others; Samsung attributes these to a glitch it calls unrelated to the data exposure, leaving two open questions instead of one resolved incident.
Second-order effects
- Carrier partners are directly exposed through Samsung's storefront: Sprint's 2019 disclosure showed that a flaw on Samsung's website reaches carriers' customers, so any partner whose devices are sold there inherits the disclosure burden when Samsung stays quiet.
- Samsung's refusal to comment on the 'dodgy app' pushes security researchers and press to keep digging, extending the news cycle past the point a fuller initial statement would have ended it.
Third-order effects
- If the sequence holds — user-visible data leakage in 2020, source code and encryption material leaked in 2022, then customer records stolen from US systems — Samsung's web and account infrastructure becomes a case study in how incremental disclosures fail to restore trust, inviting regulators to treat repeated partial admissions as a single ongoing control failure rather than isolated events.
The trend: Consumer-device makers are being forced from reactive, minimal breach disclosures toward continuous accountability for their web properties, as each partial admission gets stitched into a public record of systemic weakness.