HYBE, the company behind BTS and SEVENTEEN, says hackers got into its systems twice this fall and exposed employees’ ID, passport, bank and medical details. No fan or artist data has been reported.
HYBE, the South Korean company behind BTS, SEVENTEEN, TXT and LE SSERAFIM, says hackers got into its systems and exposed personal data from its own workers. The leak is a big one, and some of what got out is about as sensitive as it gets.
The story broke wide in English on Nov. 1 and 2, through Koreaboo, the Korea Times and Korea JoongAng Daily. HYBE actually posted its apology on its website back on Oct. 18, so the company has known for a couple of weeks.
What data did HYBE lose in the hack?
The Korea Times and JoongAng Daily list what got out. It includes names, resident registration numbers and passport numbers. It also includes bank account and card numbers, phone numbers, email and home addresses, and medical information.
Dates of birth, IP addresses, employee numbers and department names got out too. What leaked varies from person to person, and Star News counted 15 kinds of data in all.
HYBE hasn’t said how many people were affected.
Who was affected by the HYBE data breach?
Current and former HYBE employees, plus staff at partner companies, per the Korea Times and JoongAng Daily.
If you’re an ARMY or a CARAT, you can breathe. TopStarNews reported there’s no confirmation that data from fans or HYBE’s artists was exposed, and none of the outlets we read said any idol’s information leaked.
How did hackers get into HYBE?
JoongAng Daily reported that the attackers came in through an outside vendor’s document preview tool that was linked to HYBE’s electronic approval system. From there, they reached the system HYBE uses to process expenses. That may be how bank and card numbers ended up in the mix, though HYBE hasn’t spelled that out.
Koreaboo and TopStarNews, citing Korean reports, said the break-ins happened in two windows. The first ran from about 1 p.m. on Sept. 12 to about 11 a.m. on Sept. 13. The second ran from late on Oct. 3 into the afternoon of Oct. 5, Korea time.
HYBE found the problem during an internal security check, JoongAng Daily said. It hasn’t published the exact date it noticed.
What did HYBE say about the leak?
The company’s notice on its site was titled “Apology and Notice Regarding the Personal Data Breach,” TopStarNews reported.
“We deeply apologize for the concern caused by the personal information leak,” HYBE said, in a translation carried by the Korea Times and JoongAng Daily. “We sincerely apologize once again.”
According to Koreaboo, HYBE also said it “will strengthen access control and monitoring systems within the company to prevent recurrence.” The company says it blocked the attackers’ IP addresses and access routes and shut down the document preview service. It also says no misuse of the data has been reported so far.
What should affected HYBE workers do?
HYBE says it’s contacting affected people one by one. Its main advice, as translated by Koreaboo, is simple. Don’t answer anyone pretending to be the company or its staff who asks for account info, money or sensitive materials.
It also told people not to open attachments or click links in emails from senders they don’t know. That’s good advice for the rest of us, too.
HYBE reported the breach to the Korea Internet and Security Agency and the Personal Information Protection Commission, the country’s privacy regulator, per the Korea Times. We didn’t see any report of a formal investigation yet.
Is this the first data scare at HYBE?
No. Its fan platform company, Weverse, disclosed a separate leak on Sept. 6 tied to 422,584 accounts, covering payment methods, purchase and refund amounts and dates. Weverse said the internal IDs involved don’t directly identify people, TopStarNews and JoongAng Daily reported.
Nobody has linked that incident to this one.
HYBE is also in big company. South Korea has had a rough stretch of breaches. The Korea Times noted that the country’s privacy regulator fined SK Telecom 134.8 billion won in August 2025 over a hack that hit about 23 million subscribers. Online retailer Coupang disclosed a breach affecting more than 33 million users in November 2025.
For K-pop fans, the bottom line for now is that nothing reported so far puts fan accounts or idols’ passports in this leak. The people who make the music happen behind the scenes weren’t so lucky.
Article compiled and written by Kambrea Pratt (editor-in-chief), Derek Gibbs (beat editor) and the Pirates & Princesses newsroom. Pirates & Princesses is part of WebReef Media.
Pirates and Princesses is your destination for Disney news, theme park updates, and the pop culture you love. From Disney cruises and travel tips to Disney fashion, food, collectibles, and movie news, PNP covers it all. Visit us at piratesandprincesses.net for daily coverage. Follow PNP on Facebook and Instagram, and listen to the Pirates & Princesses podcast on Apple Podcasts and YouTube.
Hat Tips:
Korea Times (Nov. 2, 2026), exposed data, apology translation, reports to regulators, SK Telecom and Coupang context
Korea JoongAng Daily (Nov. 2, 2026), how the hack happened and the apology
Koreaboo (Nov. 1-2, 2026), breach windows, HYBE’s response and advice
TopStarNews (Nov. 2, 2026), notice title, fans and artists, Weverse leak
Star News (Nov. 2, 2026), data categories
AI Disclosure: All articles are assigned, edited and reviewed by an experienced human editor before posting. Like most modern newsrooms, WebReef Media uses a variety of AI tools to help with accuracy and efficiency. Ways AI may be used in article creation include research, grammar, fact-checking and ideation, as well as occasional AI generated or enhanced thumbnails or graphics. No articles are generated or posted without human oversight or involvement.