HYBE, the South Korean music company behind BTS, has confirmed that attackers got into two of its internal business systems. The way in was document preview software from an outside vendor, linked to HYBE's electronic approval system. The company says it found the access during an internal security review. Attackers took internal documents holding personal data on current and former employees and on staff at partner companies in Korea. The exposed data includes resident registration numbers, passport numbers, bank account and card numbers, and medical information. HYBE has given two intrusion windows: Sept. 12-13 and Oct. 3-5, 2026. It has not said how many people are affected and has not named the vendor or the attacker. Nobody has claimed the attack publicly.
What Happened
HYBE posted an apology on its website. The Korea Times, Seoul Economic Daily and other Korean outlets give the date as Oct. 18. JKN reports it as November 18, which cannot be right because JKN's own article ran on Nov. 2, so Oct. 18 is the reliable date. The incident only became widely known on Nov. 2, when Korean media picked it up through industry sources. Seoul Economic Daily and Yonhap called the disclosure "belated."
The company says the timeline went like this:
- Discovery: An internal security review found signs of unusual outside access to a vendor's document preview tool connected to the electronic approval system.
- Expansion: Further investigation found similar unauthorized access in HYBE's expense processing system.
- Exfiltration: HYBE says "some internal documents stored in the two systems" and the personal data inside them were "leaked externally."
- Response: HYBE says it blocked the IP addresses and access paths the attackers used. It reported the incident to the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission (PIPC), as Korean law requires, and it is notifying affected people individually.
Neither regulator has published anything on the case yet. HYBE says it has received no reports that the stolen data has been misused.
What Was Taken
HYBE has not given a number of affected people in any public statement. Reports agree on that.
Reports list different data types. The fullest list comes from the Korea Daily, which quotes HYBE's notice:
- Names, dates of birth, employee ID numbers and department names
- Resident registration numbers and foreign resident registration numbers
- Passport numbers
- Bank account numbers and credit or payment card numbers
- Mobile and landline phone numbers, email addresses and home addresses
- Medical information
- Automatically generated data such as IP addresses
Seoul Economic Daily and JKN give shorter lists that leave out medical data and contact details. The Korea Times, IBTimes Singapore and Hankyoreh all report that medical records were included. HYBE says the exposed fields differ from person to person, so each notification letter lists that person's own data.
The affected people are current and former HYBE employees and staff at partner companies. Nothing reported so far suggests that fan or customer data was in either system. Separately, the Korea Times notes that HYBE's platform subsidiary Weverse Company reported a leak in September involving 422,584 accounts. No outlet has linked the two incidents.
Why It Matters
Korean resident registration numbers stay with a person for life. Combined with passport numbers, bank details and medical information, they give criminals what they need for identity fraud and account takeover, and they can't be reissued the way a card can.
The data also includes employee IDs, department names and internal documents. That gives attackers what they need for convincing phishing that pretends to come from HYBE departments or staff. HYBE is warning about exactly this. Cyera's recent research on stolen employee directory data made the same point: org-chart details that look harmless are enough for targeted social engineering.
The bigger lesson is where the attack started. A document preview add-on was attached to the system where documents get approved, so it could read everything that passed through. Ostorlab argued this month that file-handling systems "look like plumbing" but sit "right next to the data people care about." HYBE's breach fits that pattern. The approval and expense systems held passport scans, card details and medical paperwork because that is what expense claims and HR approvals contain.
Korea's privacy regulator has issued large fines before. In August 2025 the PIPC fined SK Telecom 134.8 billion won over a breach affecting about 23.24 million subscribers. HYBE now has to explain why it took weeks to disclose an intrusion that started in mid-September.
The Attack Technique
HYBE has said only that the first access came through the outside vendor's document preview software. It has not said whether that meant a software vulnerability, stolen vendor credentials, or a misconfigured preview service exposed to the internet. Nobody has published indicators of compromise, CVE identifiers or malware details.
HYBE's account suggests two things:
- Third-party component as the entry point. Preview tools usually need broad read access to approval documents so they can render them. Anyone who compromises the tool gets that access too.
- Spread to a second system. The same kind of access later appeared in the expense processing system. That points either to shared infrastructure or credentials, or to the attackers coming back with the same method.
There were two separate windows about three weeks apart, and blocking IPs was part of the fix. That fits with attackers reusing a working entry point. However, HYBE has not said whether it found the first intrusion before the second one happened.
What Organizations Should Do
- Inventory third-party components attached to approval, HR and expense systems. Document previewers, converters and viewer plugins often run with service-level read access that nobody reviews. Map what each one can reach.
- Take preview and conversion services off the internet. Put them behind authentication and network restrictions, and patch them on the same schedule as the systems they serve.
- Cut down sensitive attachments in workflow systems. Mask resident registration, passport and card numbers in stored approval and expense documents, and set retention limits so years of old documents aren't sitting there to be taken.
- Watch for unusual bulk document access. Alert on large or out-of-hours reads by service accounts and integrations, not only by users. Treat repeated access from new IPs as a possible incident.
- Get employees ready for impersonation phishing. After a breach that exposes employee IDs and departments, warn staff and partners quickly about fake internal requests for money, credentials or files, as HYBE has done.
- Write breach notice and log access rights into vendor contracts. Require fast incident notification and access to logs from suppliers, so a compromise in a vendor's component doesn't go unnoticed for weeks.
Sources: HYBE data breach exposes employee medical records, financial detail... | HYBE Says Hackers Leaked Staff Passport, Card and Bank Data - Seoul... | HYBE suffers data breach of current and former employees, including... | HYBE hack — Employee Personal Data Leaked in Security Breach | HYBE Data Breach: BTS Agency Reveals Employee and Business Par... | HYBE Data Breach Exposes Employee Medical Records ... | Data, on the House The Breach Brief | No Passwords, No Customer Data, Still a Problem