HYBE, the company behind BTS, says hackers walked off with its employees’ resident registration numbers, passport numbers, bank account and credit card numbers, and in some cases medical information — and it took the company until October 18 to say so publicly, more than a month after the first intrusion.
The story is one of the most-searched items in Korea today because the details of what was taken have only now been widely reported. It is also HYBE’s second data-security apology in two months.
What happened
According to HYBE’s notice and reporting by the Korea Times, Korea JoongAng Daily and Seoul Economic Daily, the company found signs of abnormal outside access during an internal security inspection. The entry point was a document-preview tool from an outside vendor that was connected to HYBE’s electronic approval system — the software employees use to route paperwork for sign-off. Investigators then found similar access to the company’s expense-processing system. Internal documents stored in both systems, and the personal data inside them, were taken.
The unauthorized access happened in two windows: September 12–13 and October 3–5. The victims are current and former HYBE employees and staff at partner companies. Depending on the person, the exposed data could include names, dates of birth, phone numbers, home and email addresses, employee numbers and departments, resident registration numbers, alien registration numbers, passport numbers, bank account and card numbers, IP addresses, and medical information. HYBE has not said how many people are affected.
The company says it has fully blocked the IP addresses and access routes used in the attack, notified the people affected, and reported the incident to the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission (PIPC), as Korean law requires. Its notice said: “We deeply apologize for the concern caused by the personal information leak.” It added that no misuse of the data has been reported so far, and warned staff not to open attachments or links from unknown senders or respond to messages impersonating HYBE employees.
Why it matters more in Korea
The item that makes Korean readers wince is the resident registration number. Every Korean citizen gets one at birth, and it functions as a universal identifier for banking, healthcare, phone contracts, employment and most government services. Unlike a password, it cannot be changed except in narrow circumstances, so a leaked number is a lifelong problem for the person it belongs to. Pair it with a passport number, bank account and home address, and you have a ready-made identity-theft kit.
The breach also lands in a bad year for Korean data security. In August 2025, the PIPC fined SK Telecom 134.8 billion won (roughly $95 million) over a breach affecting about 23.24 million subscribers. Coupang, the country’s biggest online retailer, disclosed last November that a breach affected more than 33 million users. Last month, banks and other financial institutions reported breaches tied to an alleged AI-assisted attack, and the travel platform Myrealtrip said on October 29 that passport numbers had been exposed. A music label losing its staff’s medical records is, in that context, less an outlier than a trend line.
For HYBE specifically, it is a repeat. On September 6, its affiliate Weverse Company — which runs the Weverse fan platform — disclosed a separate leak involving data linked to 422,584 accounts, including payment methods and purchase and refund amounts. The company that sells fans a direct line to their idols now has two privacy apologies on the books this autumn.
What happens next
HYBE says it will tighten access controls and security monitoring on internal systems, identify the root cause, and overhaul its security framework. The outside vendor whose preview tool served as the way in has not been named.
The bigger question is what the PIPC does. The commission has shown it is willing to levy nine-figure fines when it finds safeguards inadequate, and its review will weigh HYBE’s month-long gap between intrusion and disclosure and its reliance on a third-party tool wired into its approval system. For a company whose business is persuading millions of fans to hand over their data, that finding will matter well beyond the HR department.