Weverse Confirms Data Leak Affecting More Than 422,000 Accounts

Weverse has confirmed a data leak affecting more than 422,000 account records after a security vulnerability exposed internal user identifiers and transaction-related information.

In a notice issued by Weverse Company, the platform said 422,584 cases were affected when counted by account ID.

The company became aware of the vulnerability on September 3, when the Korea Internet & Security Agency, or KISA, notified it that an external reporter had identified a security issue in the Weverse service.

Weverse said it immediately began an internal investigation and emergency response.

The personal information exposed consisted of internal identification numbers automatically generated when users register for the service. Weverse stressed that those identifiers are used internally and do not include directly identifying information such as names or contact details.

Additional transaction information was also exposed, including payment method, payment gateway provider, currency, purchase and cancellation amounts, transaction dates and times, purchase status and refund timing.

According to Weverse, those transaction fields are categorized separately from personal information.

The company said the exposed internal identifiers alone would be difficult to use for fraudulent payments or unauthorized transfers.

Weverse has since strengthened access controls around the API used to process payment information and removed internal identifier information from external exposure. It reported the incident and its response measures to KISA on September 4.

Customers determined to have been affected are also being notified individually in accordance with applicable regulations.

Weverse said it plans to review its externally exposed APIs more broadly, strengthen security monitoring and pursue legal responsibility against the outside actor it says accessed the information illegally.

The incident puts renewed attention on the infrastructure supporting K-pop’s increasingly centralized fan economy.

Weverse has grown beyond a community platform into a major hub for memberships, merchandise, albums, concert-related purchases and direct artist-to-fan services. A security failure affecting hundreds of thousands of account records therefore reaches beyond an isolated technical problem and into the systems fans increasingly rely on to participate in the industry.