HYBE data breach exposes employee medical records, financial details

HYBE, the music agency responsible for K-pop sensation BTS, announced on October 18 that a cyberattack had compromised the personal information of current and former employees and business partners. The leaked data included sensitive details such as resident registration numbers, credit card numbers, and medical records.

In a statement on their website, HYBE acknowledged that the breach occurred between September 12-13 and October 3-5. The unauthorized access was traced back to an external vendor's document preview software integrated with HYBE's electronic approval system. Further probing revealed similar breaches in their expense management system.

The compromised information also encompassed passport numbers, bank account details, residential addresses, and phone numbers. However, the company did not specify the exact number of individuals affected by the breach.

HYBE expressed deep regret for the distress caused by the leak of personal information. In response to the incident, the company took immediate action, blocking the attackers' internet addresses and access routes. They also reported the incident to relevant authorities, including the Korea Internet and Security Agency and the Personal Information Protection Commission.