[Exclusive] HYBE Also Suffers Data Breach Involving Bank Accounts, Passports, Credit Cards, Resident Registration Numbers, and Even Medical Information n.news.naver.com/article/028… Reporter Lee Jung-guk - Personal information belonging to former and current employees and business partners leaked; incident only came to light belatedly following an announcement last month. It has belatedly come to light that HYBE, South Korea’s largest entertainment agency, suffered a hacking incident involving its internal systems, resulting in the mass leakage of personal information belonging to former and current employees as well as business partners. The leaked information reportedly includes resident registration numbers, credit card numbers, and even medical information, raising serious concerns about the company’s information security management. According to HYBE’s official website, on November 2, the company’s announcement titled “Apology and Notice Regarding Personal Information Leakage,” which was posted on October 18, stated that HYBE recently discovered unauthorized external access to a document preview solution operated by an outside vendor and integrated with its internal electronic approval system during an internal security inspection. Further investigation revealed similar unauthorized external access to the company’s expense processing system. HYBE determined that, in the process, some internal documents and personal information stored in both systems had been leaked. The data breaches occurred on two separate occasions: first, from 1:16 p.m. on September 12 until 11:14 a.m. the following day, and again from 10:41 p.m. on October 3 until 3:05 p.m. on October 5. The leaked information included names, resident registration numbers, foreigner registration numbers, passport numbers, bank account numbers, credit card numbers, mobile phone numbers, email addresses, residential addresses, medical information, dates of birth, IP addresses, employee identification numbers, and department names. However, the specific information exposed varied from person to person. HYBE has not disclosed the total number of individuals affected or the overall scale of the data breach. HYBE stated that it had implemented security measures to prevent further leaks, including blocking the IP addresses and access routes used in the external attacks. The company also confirmed that it had filed reports with the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission (PIPC), and that it was individually notifying those whose information had been compromised. HYBE stated: “We sincerely apologize for causing concern due to the leakage of personal information. We will further strengthen access controls and security monitoring across our internal systems, thoroughly investigate the cause of the incident, and improve our security infrastructure to prevent similar incidents from happening again.” The company added that, so far, it had not received any reports of suspected cases involving the misuse of the leaked personal information. HYBE also informed affected individuals that, under the Personal Information Protection Act, they may seek compensation for damages or statutory damages resulting from the incident. They may also file for dispute mediation with the Personal Information Dispute Mediation Committee. Not HYBE’s first personal information breach This is not the first time HYBE has experienced a personal information leak. Previously, a data breach also occurred on Weverse, the fan platform operated by HYBE subsidiary Weverse Company. On September 6, Weverse Company disclosed that information associated with 422,584 account IDs had been leaked. The exposed information included users’ internal identification numbers, payment methods, purchase and cancellation amounts, as well as the dates and times of purchases and refunds. At the time, Weverse Company explained that it had identified a security vulnerability through an external report, adding that it had strengthened access controls and notified the relevant authorities. Concerns over the information security management systems of HYBE and its subsidiaries are growing as incidents involving not only external hacking but also unauthorized data leaks by internal employees continue to emerge. In January, it was revealed that a Weverse Company employee had unlawfully disclosed the personal information of fans who had entered fan-signing event raffles to an acquaintance. In 2021, a system development error at Weverse Company also resulted in 137 cases of personal information being exposed to unauthorized individuals. The company was subsequently fined 7 million won (approximately KRW 7 million) and issued a corrective order by the Personal Information Protection Commission.