South Korea's SM Entertainment, DearU, Dream Maker Hit by External Hack

South Korea's SM Entertainment (041510) and its affiliates DearU and Dream Maker have confirmed that their business systems were breached by external attackers, leaking sensitive employee personal data including resident registration numbers and bank account numbers. The incident is believed to have occurred around the 4th of this month, and the three companies are currently determining the scope of the leak and individually notifying those affected.

SM Entertainment said in a notice on its website on the 8th that "during recent internal security monitoring, we confirmed that an external attacker gained unauthorized access to business systems including the electronic approval system, and that some stored document files were leaked externally." The disclosed leaked items include employees' names, mobile phone numbers, addresses, bank account numbers, resident registration numbers, organizational information such as department, position and title, and some details contained in contracts.

The damage was not limited to the parent company. DearU, the IT affiliate that operates the fan communication platform Bubble, also confirmed the same incident and posted a notice it. An external attacker is understood to have gained unauthorized access to the affiliate-operations business system used by DearU and exfiltrated some document files stored in the electronic approval system and elsewhere. The leaked employee database (DB) contained names and English names, gender, date of birth, employee number, internal ID, email address, mobile phone number, department, position, title, rank and job duties, and hire date. However, the items actually leaked vary by individual, and the exact number of affected people and leaked records has not been disclosed.

Dream Maker, the concert planning affiliate, also confirmed a breach of the same type of business system around the 4th, and was notified of the same leaked information items as SM Entertainment.

The leaked information items disclosed by the three companies are summarized below.

Note: The items actually leaked may differ by individual, and the exact number of affected people and leaked records has not been disclosed.

Immediately after becoming aware of the incident, each company took steps to prevent further leaks, including blocking the internet protocol (IP) addresses and access routes used in the attack and replacing the keys used for unauthorized access. The companies said they are determining the scope of the leak in cooperation with the affiliate that operates the systems and with the relevant authorities, and are verifying the damage information for each affected individual and sending individual notifications sequentially by email or text message.

SM Entertainment said "no secondary harm from misuse of the leaked personal information has been confirmed so far," and urged caution against voice phishing and smishing that impersonate company officials. All three companies plan to pursue a detailed investigation and additional security checks in cooperation with South Korean government authorities and outside expert organizations, and to strengthen access controls and security monitoring for internal systems.

The breach shows that employee HR and contract information held by an entertainment company can leak simultaneously across affiliates through a single compromise of a business system. As the leaked data includes items directly tied to financial fraud and identity theft, such as resident registration numbers and bank account numbers, calls to review personal data management systems across South Korea's entertainment industry are expected to grow once the number of affected individuals is confirmed. Another challenge is that in structures where affiliates or link business systems, the theft of access credentials at one point can spread risk across an entire group.