Personal data of employees and partners exposed
Third data incident at Hybe affiliate this year
Follows Weverse staff leak in January and 422,000-account breach in September
Hybe, South Korea's largest entertainment company, has suffered a cyberattack that exposed sensitive personal data of current and former employees and business partners — including resident registration numbers, passport numbers, bank account and card numbers, and medical information. It is the third personal data incident at a Hybe affiliate this year.
The company posted an apology and notice on its official website on Oct. 18, disclosing the breach.
Hybe said it discovered signs of unauthorized external access to a third-party document preview solution linked to its electronic approval system during a routine internal security check. In the course of further investigation, it confirmed that unauthorized access of a similar nature had also occurred in the expense processing system.
The breach occurred in two separate incidents. The first ran from 1:16 p.m. on Sept. 12 to 11:14 a.m. the following day; the second from 10:41 p.m. on Oct. 3 to 3:05 p.m. on Oct. 5. Internal documents stored in both systems — and the personal data contained within them — were exfiltrated during those windows.
The compromised data includes names, resident registration numbers, alien registration numbers, passport numbers, bank account numbers, card numbers, mobile and landline phone numbers, email addresses, physical addresses, medical information and dates of birth. Some individuals also had their IP addresses, employee ID numbers and department names exposed. The specific items leaked varied by person, depending on what documents each individual had processed or approved. Hybe did not disclose the total number of people affected or the overall scale of the breach.
The company blocked all IP addresses and access routes used in the attack and suspended the third-party document preview service at the center of the incident. It filed reports with the Korea Internet & Security Agency and the Personal Information Protection Commission as required by law, and is notifying affected individuals of the specific data items leaked. Former employees and partner company staff whose contact information is no longer on file can verify whether their data was compromised through a dedicated inquiry channel after identity verification. "No suspected cases of personal data misuse have been reported to date," Hybe said.
The company also warned of potential secondary harm, urging people not to respond to any contact impersonating Hybe departments or staff and requesting account credentials, money or sensitive materials. It also asked recipients to refrain from opening attachments or clicking links in emails from unverified sources.
This is not the first data incident involving a Hybe affiliate. In September, the fan platform Weverse — operated by subsidiary Weverse Company — suffered a breach affecting 422,584 accounts. That leak, which occurred in two separate incidents in July and August, exposed internal identification data, payment method details, and purchase and refund histories. The company became aware of the breach only after receiving an external tip through the Korea Internet & Security Agency.
In January, a Weverse employee was found to have shared the names and birth years of fan sign event applicants in a group chat with acquaintances. The same employee also leaked a list of 30 winners of a public broadcast event, which included their names, dates of birth and phone numbers, and the company filed a criminal complaint against the individual. In November 2021, the Personal Information Protection Commission fined Weverse Company 7 million won ($5,230) after a development error allowed users to log into other people's accounts, exposing 137 individuals' personal data to other users. In October 2024, an internal Hybe report containing assessments of idol appearances circulated widely after surfacing at a national audit and spreading through online communities.
"Going forward, we will further strengthen access controls and security monitoring across our internal systems, and make every effort to prevent recurrence through thorough root-cause analysis and improvements to our security framework," Hybe said.
shee@heraldcorp.com
