HYBE, the South Korean agency known for managing BTS, has confirmed that a cyberattack exposed sensitive personal data belonging to current and former employees as well as business partners, according to Korea Times. The leaked material reportedly included resident registration numbers, passport details, bank and credit card information, and medical records.
- HYBE, the agency behind BTS, disclosed a cyberattack affecting current and former employees and business partners, according to Korea Times.
- Breaches occurred in two windows: September 12-13 and October 3-5, per HYBE's apology cited by Korea Times and Koreaboo.
- Exposed data reportedly included resident registration numbers, passport numbers, bank and card details, medical records, addresses and phone numbers.
- HYBE has not disclosed how many people were affected, Korea Times reported.
- The company said it blocked the attackers' access routes and reported the incident to the Korea Internet and Security Agency and the Personal Information Protection Commission.
What happened
HYBE posted an apology on its website on October 18, saying an internal security review had detected unauthorized access traced to an outside vendor’s document preview tool connected to its electronic approval system, Korea Times reported. A follow-up investigation then uncovered similar unauthorized access in the company’s expense management system.
Per the company’s own account, cited by both Korea Times and Koreaboo, the intrusions happened in two separate windows: September 12 to 13, and October 3 to 5. Koreaboo reported more precise timestamps from HYBE’s notice, noting the first incident ran from early afternoon on September 12 into the following morning, while the second stretched from late evening on October 3 into the afternoon of October 5.
Beyond the headline categories of medical and financial records, the leak reportedly touched addresses, phone numbers, email addresses and dates of birth. Koreaboo added that depending on an individual’s role and approval history, some exposed files also contained IP addresses, employee numbers and department names.
Why it matters
The breach is notable both for who it hit and what it exposed. HYBE is described by Koreaboo as South Korea’s largest entertainment company, and the leaked categories go well beyond routine contact information into government ID numbers, passport data and health records — the kind of details that can enable identity theft or financial fraud if misused.
Our read: the combination of medical and financial data in one breach raises the stakes for affected individuals beyond typical corporate hacks, since this information is harder to change or protect after exposure than a password or email address.
Background
This is not an isolated event for HYBE’s corporate ecosystem. Korea Times noted that the disclosure follows earlier privacy problems at HYBE’s subsidiary, Weverse Company, whose fan platform reported in September that information tied to 422,584 accounts had leaked, including internal identifiers and transaction records. A separate incident in January involved an employee improperly disclosing fan information, according to the same report.
Korea Times also placed the HYBE case within a broader pattern, pointing to data breaches at banks and other financial institutions in South Korea the previous month, reportedly linked to a cyberattack involving artificial intelligence. This suggests cybersecurity lapses are a recurring challenge across multiple industries in the country, not just entertainment.
What to watch
HYBE said it has blocked the internet addresses and access routes used by the attackers and has reported the incident to the Korea Internet and Security Agency and the Personal Information Protection Commission, according to Korea Times. The company is also in the process of notifying affected individuals directly and says no misuse of the leaked data has been reported so far.
Koreaboo reported that HYBE urged employees and partners not to respond to anyone impersonating the company or its staff requesting account details, money or sensitive materials, and warned against opening attachments or clicking links from unknown senders. The company also pledged to tighten access controls and monitoring systems to prevent a repeat.
Whether HYBE eventually discloses the number of people affected, and whether regulators take further action following the reports to Korean authorities, remain open questions. The outcome could influence how other K-pop agencies, many of which handle similarly sensitive data on staff, trainees and fans, approach their own cybersecurity practices going forward.
Frequently asked questions
What personal data was exposed in the HYBE breach?
According to HYBE's apology, leaked data included resident registration numbers, passport numbers, bank account and card details, medical information, addresses, phone numbers and dates of birth.
How did the hackers get in?
HYBE said an internal security check found unauthorized access through an outside vendor's document preview tool connected to its electronic approval system, with a similar intrusion later found in its expense management system, per Korea Times.
Has HYBE said how many people were affected?
No, Korea Times reported that the company did not disclose the number of people impacted by the breach.
Sources
- The Korea Times: HYBE data breach exposes employee medical records, financial details
- Koreaboo: HYBE Gets Hacked, Personal Information Leaked
This article was prepared with AI assistance from the reports listed above and automatically checked against them. See About for how we work.
Leave a Reply