HYBE Confirms Sensitive Employee and Partner Data Exposed in Cyberattack

HYBE has confirmed that unauthorized access to its internal systems resulted in the exposure of sensitive personal information belonging to current and former employees and personnel at partner companies.

The entertainment company first disclosed the incident in an official notice published October 18. The breach received wider attention on November 2 following reports from South Korean news outlets.

According to HYBE, an internal security inspection identified abnormal external access to a third-party document-preview solution connected to its electronic approval system. Further investigation revealed similar unauthorized access involving the company’s expense-processing system.

The incidents occurred during two periods, September 12–13 and October 3–5. Some internal documents stored in the affected systems, along with personal information contained in those documents, were exposed.

The compromised information included names, national identification numbers, passport numbers, bank account details, payment card numbers, contact information, residential addresses and medical information. The specific categories of exposed information varied between affected individuals.

HYBE has not publicly disclosed the total number of people affected.

In its notice, the company said it had blocked the IP addresses and access routes used in the attack and reported the incident to the Korea Internet & Security Agency and the Personal Information Protection Commission. Affected individuals were also being contacted about their exposed information.

HYBE said it had received no reports of suspected misuse of the leaked information at the time of its statement. The company apologized and pledged to strengthen internal access controls, security monitoring and measures intended to prevent similar incidents.

The breach concerns HYBE’s corporate employee and partner information. It is separate from the previously disclosed September data incident involving its Weverse fan platform. No evidence has been established that artists’ or fans’ personal information was exposed in this corporate incident.