HYBE data breach exposes employee medical records, financial details

HYBE, the music agency responsible for K-pop sensation BTS, recently announced a cyberattack that resulted in the exposure of sensitive personal data belonging to both present and former employees as well as business associates. This information breach includes details such as resident registration numbers, credit card numbers, and medical records.

In an apology posted on their official website on October 18th, HYBE detailed the incident, revealing that the unauthorized access was initially discovered through an internal security inspection conducted on their electronic approval system, which utilized document preview software from an external vendor. Upon further scrutiny, the company found that similar unauthorized access had occurred to their expense management system.

The unauthorized access took place between September 12th and 13th, as well as October 3rd and 5th. The compromised information also included passport numbers, bank account details, residential addresses, and telephone numbers. Nevertheless, HYBE has not disclosed the exact number of individuals affected by the breach.

In response to the incident, the company has taken immediate action. They have blocked the attackers' internet addresses and access routes, reported the incident to relevant authorities, including the Korea Internet and Security Agency and the Personal Information Protection Commission, and is actively working to mitigate any potential damage caused by the breach.