What personal information was exposed in the HYBE employee data breach?

The compromised records included resident registration numbers, credit card numbers, medical records, passport numbers, bank account details, addresses and phone numbers. The affected groups included current and former employees and business partners.

How did attackers gain access to HYBE’s systems, and when did the breaches occur?

HYBE said an internal security inspection found unauthorized access through an outside vendor’s document preview software connected to its electronic approval system. Further investigation found similar access to its expense management system; the breaches occurred Sept. 12-13 and Oct. 3-5.

HYBE data breach exposes employee medical records, financial details

Q: What steps did HYBE take after discovering the data breach, and was misuse reported?

HYBE said it blocked the attackers’ internet addresses and access routes, reported the incident to the Korea Internet and Security Agency and the Personal Information Protection Commission, and was notifying affected individuals. The company said no suspected misuse had been reported.

Listen

Summary

HYBE disclosed a cyberattack that exposed personal information of current and former employees and business partners in Korea, with breaches occurring Sept. 12-13 and Oct. 3-5. The company said unauthorized access came through an outside vendor’s document preview software linked to its electronic approval system and also affected its expense management system. HYBE reported the incident to authorities, blocked the access routes and said it was notifying affected people; it had received no reports of suspected misuse.

Key Facts

The exposed information included resident registration numbers, credit card numbers, medical records, passport numbers, bank account details, addresses and phone numbers.
HYBE did not disclose how many people were affected.
The company said it reported the incident to the Korea Internet and Security Agency and the Personal Information Protection Commission.
Weverse Company reported in September that information associated with 422,584 accounts had leaked, including internal identifiers and transaction details.
In August 2025, the privacy commission imposed a 134.8 billion won penalty on SK Telecom after a breach compromised approximately 23.24 million subscribers’ data.

By Lee Hae-rin

Published Nov 2, 2026 3:53 pm KST

This July 24, 2024 file photo shows HYBE's headquarters in Seoul's Yongsan District. Newsis

HYBE, the music agency behind K-pop group BTS, disclosed a cyberattack that exposed personal information of current and former employees and business partners, including resident registration numbers, credit card numbers and medical records.

In an apology posted on its website, Oct. 18, the company said an internal security inspection detected unauthorized access through an outside vendor’s document preview software linked to its electronic approval system. Further investigation found similar access to its expense management system.

According to the apology, the breaches occurred Sept. 12-13 and Oct. 3-5. Compromised information also included passport numbers, bank account details, addresses and phone numbers. The company did not disclose how many people were affected.

“We deeply apologize for the concern caused by the personal information leak,” HYBE said in the notice.

HYBE's announcement and public apology on a recent personal information leak / Captured from HYBE website

The company also said it blocked the attackers’ internet addresses and access routes, reported the incident to the Korea Internet and Security Agency and the Personal Information Protection Commission, and was notifying affected individuals. It said no suspected misuse had been reported.

The disclosure follows repeated privacy incidents at subsidiary Weverse Company. Its fan platform reported in September that information associated with 422,584 accounts had leaked, including internal identifiers and transaction details. An employee’s unauthorized disclosure of fan information also emerged in January.

The incident adds to Korea’s recurring data security failures.

Last month, personal data breaches took place at banks and other financial institutions in an alleged cyberattack involving artificial intelligence. In August 2025, the privacy commission imposed a 134.8 billion won penalty on SK Telecom after a breach compromised approximately 23.24 million subscribers’ data, citing inadequate safeguards. Online retailer Coupang has also faced scrutiny over a breach disclosed last November that affected over 33 million users and exposed customers’ names, phone numbers and delivery details.

Explore More