The Financial Supervisory Service has begun formal on-site inspections of South Korean payment gateway companies CoamPayments and Toss Payments after separate incidents involving potentially exposed payment information. CoamPayments said an attack ran from 8:13 a.m. on August 30 to 5:34 a.m. on September 1 and was discovered at 8:00 a.m. on September 2. The company said the exposed data may include card numbers, expiration dates, dates of birth and card passwords, although the precise scope remains under review. Toss Payments said its own system was not hacked; rather, payment information held by merchants using its PG service was leaked. It said the data included buyer names, masked card numbers, approval numbers and receipt-level payment details, which cannot by themselves be used for payments or cancellations. Toss said it had blocked the leak route, notified affected customers and found no confirmed fraudulent payments. The FSS said IP tracing suggested a Chinese connection but could not establish the attacker’s nationality because of methods used to bypass IP tracking. The investigation is also examining previously reported exposure involving tens of thousands of records, including data linked to nearly all South Korean card companies, as well as breach routes, security controls and potential secondary losses.