SM Entertainment hacked, joining Hybe as K-pop agencies face wave of data breaches

Electronic approval system breached around Wednesday; DearU and Dreammaker also hit

SM Entertainment and two of its affiliates have suffered a cyberattack that exposed resident registration numbers, bank account details and contract information, making the company the latest major K-pop agency to be targeted after Hybe was hit last month.

SM said Monday that during routine internal security monitoring it confirmed an outside attacker had gained unauthorized access to its business systems — including its electronic document approval system — and exfiltrated some stored files. "We sincerely apologize for the concern this incident has caused," the company said.

According to SM, the breach occurred around Wednesday. The leaked data includes names, mobile phone numbers, addresses, bank account numbers, resident registration numbers, organizational affiliations such as department, position and title, and information recorded in contracts. The specific items exposed vary by individual. SM said it is notifying affected parties individually by email and text message.

The breach extended to affiliates as well. Concert production subsidiary Dreammaker Entertainment had the same categories of data leaked. DearU, which operates the fan-messaging app Bubble, also had its employee database compromised around the same time, with records including employees' Korean and English names, gender, date of birth, employee ID, email address, mobile phone number, department and position. DearU said the breach was limited to employees, and there is no indication that Bubble user data was affected.

SM said it immediately blocked the IP addresses and access routes used in the attack and replaced unauthorized access keys upon discovering the incident. The company plans to conduct a detailed investigation and security review with government authorities and outside specialists. SM said no secondary damage from misuse of the leaked data has been confirmed so far, but urged people to be especially cautious of calls, texts or emails impersonating SM or its associates and requesting money or financial information. The company did not disclose the time of the initial intrusion, the volume of documents taken, the number of people affected or the specific method of entry.

Hybe's electronic approval system was also breached. The company announced on its website on Oct. 18 that personal information belonging to current and former employees and business partners had been leaked. The breaches occurred in two separate incidents — Sept. 12 to 13 and Oct. 3 to 5. Attackers gained unauthorized access to a third-party document preview solution linked to the electronic approval system, and a subsequent investigation revealed that the expense processing system had been compromised in the same manner.

The data taken from Hybe included names, resident registration numbers, foreign registration numbers, passport numbers, bank account numbers, card numbers, home addresses and medical information. More than a month passed between the first breach and the public announcement, during which the second breach occurred. Hybe blocked the IP addresses and access routes used in the attack and filed reports with the Korea Internet & Security Agency and the Personal Information Protection Commission.

Fan platforms were not spared. Weverse, operated by Hybe subsidiary Weverse Company, suffered two separate incidents this year alone. In January, an employee was found to have shared personal information of fan event winners — obtained in the course of work — in a private KakaoTalk group chat without authorization. Weverse Company called it "a clear act of misconduct by a member who violated company rules and employment regulations," and said the employee had been removed from their duties and referred to a disciplinary committee.

In September, the platform was hit by an external attack. After receiving a tip about a security vulnerability through the Korea Internet & Security Agency, Weverse Company conducted an investigation and confirmed that information linked to 422,584 accounts had been leaked. The exposed data included internal identification numbers and payment-related details such as payment method, purchase amounts and dates, and refund dates. The company said the breach did not include directly identifying information such as names or contact details.

"We take this incident very seriously," SM said. "We will strengthen access controls and security monitoring across our internal systems, and make every effort to prevent a recurrence through thorough root-cause analysis and improvements to our security framework."

shee@heraldcorp.com