HYBE data breach exposes employee medical records, financial details

HYBE, the music agency behind K-pop group BTS, disclosed a cyberattack that exposed personal information of current and former employees and business partners, including resident registration numbers, credit card numbers and medical records.

In an apology posted on its website, Oct. 18, the company said an internal security inspection detected unauthorized access through an outside vendor’s document preview software linked to its electronic approval system. Further investigation found similar access to its expense management system.

According to the apology, the breaches occurred Sept. 12-13 and Oct. 3-5. Compromised information also included passport numbers, bank account details, addresses and phone numbers. The company did not disclose how many people were affected.

“We deeply apologize for the concern caused by the personal information leak,” HYBE said in the notice.

The company also said it blocked the attackers’ internet addresses and access routes, reported the incident to the Korea Internet and Security Agency and the Personal Information Protection Commission, and was notifying affected individuals. It said no suspected misuse had been reported.

The disclosure follows repeated privacy incidents at subsidiary Weverse Company. Its fan platform reported in September that information associated with 422,584 accounts had leaked, including internal identifiers and transaction details. An employee’s unauthorized disclosure of fan information also emerged in January.

The incident adds to Korea’s recurring data security failures.