HYBE, Weverse, SM Entertainment: what the K-pop hacks of autumn 2026 have in common

Published 2026-11-08

Between September and November 2026, three of the best-known names in Korean entertainment disclosed break-ins: HYBE, its fan platform Weverse, and SM Entertainment with two of its affiliates. A ticket resale platform used by K-pop fans was hit as well. None of these began with a fan's stolen password. They began in the office systems behind the music, and in the connections between those systems and the services around them.

SM Entertainment, DearU and Dream Maker (November)

On 8 November SM Entertainment said an outside attacker had got into its business systems, including its electronic approval system, around 4 November and taken some of the documents stored there. The personal data in them included names, phone numbers, addresses, bank account numbers, resident registration numbers, departments and details written in contracts. Its concert promoter Dream Maker Entertainment reported the same kind of leak, and DearU, which runs the fan messaging app bubble, lost its employee database: names, dates of birth, employee numbers, user IDs, email addresses and job titles. SM says fan information was not leaked. All three companies say they blocked the attacker's IP addresses and access routes and replaced the access keys used without authorisation. (Seoul Economic Daily, SBS)

HYBE (September and October)

HYBE, the company behind BTS, found during an internal security check that someone had got in through an outside vendor's document preview software connected to its electronic approval system, and then found the same kind of access to its expense system. Documents were taken on 12–13 September and 3–5 October. The personal data of current and former staff and business partners in them included resident registration and passport numbers, bank account and card numbers, addresses, phone numbers and medical information. HYBE posted an apology on its website on 18 October, and it was widely reported on 2 November. It has not said how many people were affected. (The Korea Times, Korea JoongAng Daily)

Weverse (September)

Weverse Company, HYBE's fan platform, said in September that data tied to 422,584 accounts had been exposed: internal user identifiers and payment details such as the payment method, amounts, dates and order status. It found out when the Korea Internet & Security Agency passed on a vulnerability report from an outside researcher. The company says these items alone can't be used for payment fraud. (Digital Music News, The Herald Business)

Ticketbay (October)

The ticket resale platform Ticketbay said an attacker abused some of its APIs on 21 October and read the data of about 16,000 members: names, user IDs, join dates and transaction details, including which shows they bought or sold tickets for. That last detail is the dangerous one. A message that names the concert you really bought a ticket for is easy to believe. (Reported in Korean by the security news site DailySecu.)

What these incidents have in common

• Office systems, not fan apps. Electronic approval and expense systems hold exactly what an identity thief wants: ID numbers, bank details, contracts. They are ordinary business software, and they are reachable from outside.
• A way in through something attached. At HYBE it was a vendor's preview component bolted onto the approval system. DearU says its leak came from a business system run by an affiliate. At Weverse and Ticketbay it was the services' own APIs.
• Keys. SM's first fix was to replace the access keys the attacker had used. Whatever the first step was, a stolen key or a vendor's credentials, the attacker then acted as a trusted system, and the clean-up begins with knowing every key and integration a system holds and being able to replace them quickly.

If you were affected

• Expect phishing that uses what was taken: your employer's name, your contract, or the concert you bought tickets for. None of these companies asks for passwords or verification codes by text or phone.
• If your resident registration number was exposed, the Korea Internet & Security Agency's 118 line helps individuals deal with leaks and scams.
• Fans: SM says bubble users' data was not part of its leak, and Weverse says the exposed items can't be used on their own to make payments. Still, treat any message about a refund or a failed payment with suspicion.

If you run systems like these

Keep a list of every API key, service account and vendor integration your business systems hold, and be ready to replace them all on the day a supplier reports an incident. That is the job KeyRotate was built for: it keeps those keys in one place and replaces them in one pass, wherever they are used. FrontierStack watches the servers behind them, including their security updates and certificates.

We follow incidents like these through our leak news feed, which now reads Korea's KrCERT/CC and KISA and the Korean security press. These particular leaks are employee and customer data at companies where our users don't keep keys, so they didn't become KeyRotate advisories. That is why they're a blog post instead. The advisories themselves are on Leak news.