Photo Credit: Hybe
K-pop powerhouse agency Hybe disclosed a cyberattack last month that exposed the personal information of current and former employees and partners.
On October 18, Hybe, the South Korean music agency behind K-pop giants BTS, quietly disclosed a cyberattack that exposed the personal information of current and former employees and business partners. The compromised information included resident registration numbers, medical records, credit card numbers, passport numbers, bank account details, addresses, and phone numbers.
The company posted an apology on its website, explaining that an internal security inspection detected unauthorised access through an outside vendor’s document preview software linked to its electronic approval system. Similar access to its expense management system was discovered following further investigation.
Hybe said the breaches occurred between September 12 and 13 and October 3 and 5. The company did not disclose the number of people affected. The post also explained that the company blocked the attackers’ internet addresses and access routes, reported the incident to the Korea Internet and Security Agency and the Personal Information Protection Commission, and was notifying affected individuals.
“We deeply apologise for the concern caused by the personal data leak,” Hybe wrote. “We will further strengthen access controls and security monitoring of our internal systems and will make every effort to prevent a recurrence through a thorough investigation of the cause and improvements to our security framework.”
In response, the Gyonggi Nambu Provincial Police Agency has reportedly opened a pre-booking investigation into the data leak, having been ordered a day prior by the Korean National Police Agency. Authorities plan to examine “how the unauthorized access to the external vendor’s system occurred and how the personal data was leaked.”
Interestingly, the breaches follow repeated privacy incidents at Hybe subsidiary Weverse. The fandom platform reported in September that information, including internal identifiers and transaction details associated with 422,584 accounts, had been leaked.
It illustrates recurring data security failures throughout South Korea, including at banks and other financial institutions affected by an alleged cyberattack that involved artificial intelligence. Last summer, the privacy commission imposed a penalty on SK Telecom after a breach compromised the data of approximately 23.24 million subscribers. A year ago, online retailer Coupang faced intense scrutiny over a breach that affected more than 33 million users, exposing customers’ names, phone numbers, and delivery details.
