HYBE Fan Platform Weverse Hit Again, Exposing Data on 422,584 Accounts

HYBE subsidiary Weverse Company said personal information linked to 422,584 account IDs leaked from its fan platform after an external tip exposed a security vulnerability.

In a notice issued on the night of Sept. 6 under Chief Executive Yang Joo-il’s name, the company said, “We received an external report about a service security vulnerability and, after conducting an inspection, confirmed that some customers’ personal information had been leaked.” The Korea Internet and Security Agency told Weverse Company on Sept. 3 that an outside reporter had identified the flaw. The company then carried out its own investigation.

The leaked data included internal identifiers created by Weverse to identify users within its system. It also included payment methods, payment gateway names, currencies, purchase and cancellation amounts, purchase times, purchase status and refund times. The company said the internal identifiers could not directly identify people in the way names or phone numbers can, and that the data alone would make payment fraud or unauthorized transfers difficult.

The incident involved a security weakness in an externally exposed API that processed payment information. Weverse Company said it strengthened the API’s access controls and removed the internal identifiers. It reported the breach to KISA on Sept. 4 and said it separately notified affected users as required by law. The company also plans to inspect all externally exposed APIs, limit the information they expose, tighten controls over service deployment and improve security monitoring. It said it had asked the outside party who illegally accessed the personal information to return it and would pursue legal responsibility.

This is not Weverse’s first privacy incident. In 2021, the Personal Information Protection Commission found that a system error allowed users to log in to other people’s accounts, exposing the names, email addresses, genders, mobile phone numbers and membership numbers of 137 users. The company received a corrective order and a 7 million won fine. In June, an employee handling fan events was found to have shared applicants’ names and birth years in a private KakaoTalk group and sent a list containing the names, birth dates and phone numbers of 30 winners of another event outside the company. Weverse hosts artists from HYBE, including BTS, Seventeen and Enhypen, as well as artists from other agencies.

“

We received an external report about a service security vulnerability and, after conducting an inspection, confirmed that some customers’ personal information had been leaked.