HYBE data breach exposes employee medical records, financial details

HYBE disclosed a cyberattack that exposed personal information of current and former employees and business partners in Korea, with breaches occurring Sept. 12-13 and Oct. 3-5. The company said unauthorized access came through an outside vendor’s document preview software linked to its electronic approval system and also affected its expense management system. HYBE reported the incident to authorities, blocked the access routes and said it was notifying affected people; it had received no reports of suspected misuse.

The exposed information included resident registration numbers, credit card numbers, medical records, passport numbers, bank account details, addresses and phone numbers.

HYBE did not disclose how many people were affected.

The company said it reported the incident to the Korea Internet and Security Agency and the Personal Information Protection Commission.

Weverse Company reported in September that information associated with 422,584 accounts had leaked, including internal identifiers and transaction details.

In August 2025, the privacy commission imposed a 134.8 billion won penalty on SK Telecom after a breach compromised approximately 23.24 million subscribers’ data.

Published Nov 2, 2026 3:53 pm KST

This July 24, 2024 file photo shows HYBE's headquarters in Seoul's Yongsan District. Newsis

HYBE, the music agency behind K-pop group BTS, disclosed a cyberattack that exposed personal information of current and former employees and business partners, including resident registration numbers, credit card numbers and medical records.

In an apology posted on its website, Oct. 18, the company said an internal security inspection detected unauthorized access through an outside vendor’s document preview software linked to its electronic approval system. Further investigation found similar access to its expense management system.

According to the apology, the breaches occurred Sept. 12-13 and Oct. 3-5. Compromised information also included passport numbers, bank account details, addresses and phone numbers. The company did not disclose how many people were affected.

“We deeply apologize for the concern caused by the personal information leak,” HYBE said in the notice.

HYBE's announcement and public apology on a recent personal information leak / Captured from HYBE website

The company also said it blocked the attackers’ internet addresses and access routes, reported the incident to the Korea Internet and Security Agency and the Personal Information Protection Commission, and was notifying affected individuals. It said no suspected misuse had been reported.

The disclosure follows repeated privacy incidents at subsidiary Weverse Company. Its fan platform reported in September that information associated with 422,584 accounts had leaked, including internal identifiers and transaction details. An employee’s unauthorized disclosure of fan information also emerged in January.

The incident adds to Korea’s recurring data security failures.

Last month, personal data breaches took place at banks and other financial institutions in an alleged cyberattack involving artificial intelligence. In August 2025, the privacy commission imposed a 134.8 billion won penalty on SK Telecom after a breach compromised approximately 23.24 million subscribers’ data, citing inadequate safeguards. Online retailer Coupang has also faced scrutiny over a breach disclosed last November that affected over 33 million users and exposed customers’ names, phone numbers and delivery details.

HYBE披露了一起网络攻击事件，导致其在韩国的现任和前任员工以及业务合作伙伴的个人信息泄露。此次攻击事件分别发生在9月12日至13日和10月3日至5日。该公司表示，未经授权的访问是通过一家外部供应商的文档预览软件实现的，该软件与其电子审批系统相连，并且还影响了其费用管理系统。HYBE已向有关部门报告了此次事件，封锁了访问路径，并表示正在通知受影响人员；该公司尚未收到任何疑​​似滥用行为的报告。

泄露的信息包括居民登记号码、信用卡号码、医疗记录、护照号码、银行账户信息、地址和电话号码。

HYBE并未透露受影响的人数。

该公司表示已将此事报告给韩国互联网安全局和个人信息保护委员会。

Weverse 公司在 9 月份报告称，与 422,584 个账户相关的信息遭到泄露，其中包括内部标识符和交易详情。

2025 年 8 月，韩国隐私委员会对 SK Telecom 处以 1348 亿韩元的罚款，原因是该公司发生数据泄露事件，导致约 2324 万用户的数据遭到泄露。

发布于2026年11月2日下午3:53（韩国标准时间）

这张摄于2024年7月24日的资料照片显示了HYBE位于首尔龙山区的总部。Newsis

韩国流行音乐组合 BTS 的经纪公司 HYBE 披露了一起网络攻击事件，该事件导致现任和前任员工以及商业伙伴的个人信息泄露，包括居民登记号码、信用卡号码和医疗记录。

该公司于10月18日在其网站上发布道歉声明称，内部安全检查发现有人通过外部供应商的文档预览软件未经授权访问了其电子审批系统。进一步调查发现，该公司的费用管理系统也遭到了类似的访问。

根据道歉声明，数据泄露事件发生在9月12日至13日和10月3日至5日。泄露的信息包括护照号码、银行账户信息、地址和电话号码。该公司没有透露受影响的人数。

“对于个人信息泄露事件造成的担忧，我们深表歉意。”HYBE在声明中表示。

HYBE就近期个人信息泄露事件发表声明并公开道歉 / 摘自HYBE网站

该公司还表示，已封锁攻击者的互联网地址和访问路径，并已向韩国互联网安全局和个人信息保护委员会报告了此事，同时也在通知受影响的个人。该公司称，目前尚未收到任何疑​​似滥用报告。

此次披露是在Weverse公司旗下子公司多次发生隐私泄露事件之后进行的。该公司旗下的粉丝平台在9月份报告称，422,584个账户的相关信息遭到泄露，包括内部标识符和交易详情。此外，今年1月还爆出一名员工未经授权泄露粉丝信息的事件。

此次事件再次暴露了韩国数据安全方面屡屡出现漏洞的问题。

上个月，银行和其他金融机构发生个人数据泄露事件，据称此次网络攻击涉及人工智能。2025年8月，韩国隐私委员会对SK Telecom处以1348亿韩元的罚款，原因是该公司数据泄露事件导致约2324万用户数据泄露，理由是其安全措施不足。此外，在线零售商Coupang也因去年11月披露的数据泄露事件而受到审查，该事件影响了超过3300万用户，并泄露了客户的姓名、电话号码和送货详情。