HYBE reports data breach involving employees, business partners

HYBE , the South Korean entertainment company behind K-pop acts including BTS , SEVENTEEN , and LE SSERAFIM , has confirmed a data breach involving some of its internal systems.

In a notice published on its official website, the company said it detected unauthorized external access during an internal security inspection. The incident exposed some internal documents and personal information stored in its electronic approval and expense-processing systems.

The affected individuals included some business partners and current and former employees. The compromised information varied by individual and included names, resident registration numbers, foreign registration numbers, passport numbers, bank account and credit card numbers, phone numbers, email addresses, addresses, dates of birth, and medical information. Some records also contained employee identification numbers, department names, and IP addresses.

HYBE said the unauthorized access occurred during two periods: Sept. 12 to 13 and Oct. 3 to 5. The company attributed the suspicious activity to an external document-preview solution connected to its electronic approval system, with similar access detected in its expense-processing system.

The company said it blocked the IP addresses and access routes linked to the incident and took additional measures to prevent further exposure. It also reported the breach to the Korea Internet and Security Agency and the Personal Information Protection Commission, and said it was individually notifying affected individuals.

HYBE apologized for the incident and said it would strengthen access controls and security monitoring to prevent similar breaches.

"Please do not respond to emails, text messages, or messenger communications that impersonate HYBE departments or employees and request account credentials, payments, or sensitive materials," the label said.

It further warned people against opening attachments or links in emails from unverified sources.

The company has not disclosed the total number of people affected. As of writing, it said it had not received reports of suspected misuse of the exposed information.