On 8 November 2026, South Korean entertainment company SM Entertainment posted an apology on its website. It said an outside attacker had got into its internal business systems, including its electronic approval system, and copied stored document files out of the company. The stolen files held personal data on employees and related parties. According to the Seoul Economic Daily, ChosunBiz and Newsis, that data includes resident registration numbers (Korea's national ID numbers) and bank account numbers. Two group companies were also hit: DearU, which runs the fan messaging app Bubble, and Dream Maker Entertainment, which plans concerts. Newsis reports that all three companies posted their own apology notices. They put the breach at around 4 November. None of them has said how many people are affected, and Newsis reports that the full scale of the damage is still being worked out. No attacker has been named, and no group has claimed the attack publicly.
What Happened
SM says it found the intrusion through its own security monitoring. In its notice, the company said that "an external attacker had gained unauthorized access to our business systems (including the electronic approval system) and leaked certain stored document files externally." Every report puts the breach at around 4 November. That means about four days passed before the public notice on 8 November.
Newsis, which reviewed the notices from all three companies, reports that DearU was hit "in the course of using a business system operated by an affiliate." In other words, DearU's own systems do not appear to have been the entry point. Its data was exposed because it relies on a work system run by another company in the group. This points to a single shared corporate platform, not three separate intrusions.
SM says that once it found the breach, it blocked all IP addresses and access paths the attacker used, and "replaced the unauthorized access keys." It says it is investigating with government authorities and outside specialist firms, and plans to review its security systems. The companies are telling affected people one by one, by email or text message, as they confirm who was exposed and which data each person lost.
All three companies say they have found no secondary harm so far, meaning no confirmed misuse of the stolen data. They have warned employees to watch for voice phishing and smishing (scam text messages) from people pretending to be the company or its staff and asking for money or financial details.
What Was Taken
What was exposed differs by company and by person. All three firms say the exact items vary from individual to individual.
SM Entertainment and Dream Maker Entertainment. The Seoul Economic Daily, ChosunBiz and Newsis all report that the exposed data includes: - names (listed by Newsis and STARNEWS) - mobile phone numbers and home addresses - bank account numbers - resident registration numbers - department, position and title - "some information recorded in contracts"
Newsis says Dream Maker listed the same items as SM. STARNEWS's English report lists everything above except resident registration numbers, although its headline includes them. Three other Korean outlets, including Newsis reporting from the notices themselves, list them. On balance, national ID numbers appear to be among the stolen data for SM and Dream Maker.
DearU. Newsis reports a different set of data, taken from an employee database. It includes names and English names, gender, date of birth, employee number, user ID, email address, mobile number, department, position, title, grade, job role and hire date. Newsis does not list resident registration numbers or bank account numbers for DearU.
Volume. No figure has been released. None of the three companies has said how many employees, contractors or other "related parties" are affected. No regulator has published a filing.
Why It Matters
Data that cannot be changed. A Korean resident registration number is used for life and is very hard to replace. Put it together with a bank account number, a home address and a phone number, and a fraudster has most of what they need to pass identity checks or run a convincing scam call. Ostorlab's research on a separate breach makes the same point: once a national ID is linked to someone's employer and job, a year of credit monitoring does little against the more serious risk, which is targeted fraud.
Contract data is a bigger concern for this company than for most. In entertainment, "information recorded in contracts" can cover pay terms, contract periods and personal details of people working with artists. The companies have not said whose contracts were in the stolen files or what they contained. That question deserves an answer.
The SM name is already used as bait. Days before this breach became public, comedian Chung Ju-ri told viewers on her YouTube channel that she had lost the channel for about five months, STARNEWS reports. She had replied to a fake copyright complaint that claimed to come from SM Entertainment. The objection link she submitted was a phishing link. Her phone was then reset, her Google account was taken over, and cryptocurrency livestreams appeared on her channel. Nothing links that incident to this breach. It does show that scammers already use SM's name to fool people. Now that real employee records, contact details and organisation charts are out, those scams can become far more convincing.
One shared system exposed several companies. DearU's account suggests a single shared approval or work platform was the weak point for at least three companies in the group. Any group that runs central HR, approval or document systems for its subsidiaries has the same exposure.
The Attack Technique
SM has not explained how the attacker got in. What it has said narrows things down. The attacker reached the business systems, including the electronic approval system, and copied stored documents. SM's fix included replacing "unauthorized access keys," which suggests the attacker used valid credentials, tokens or API keys rather than a software flaw. Electronic approval systems in Korean companies route HR, payroll, contract and expense paperwork. That makes them a natural place to find documents full of personal data.
No details of the attacker's methods or tools have been published, and no threat group has been tied to the attack. Two well-documented attack patterns fit the little that SM has disclosed. They are offered here only as comparison and are not confirmed for this case:
- Stolen login sessions from infostealer malware. IntruForce describes how infostealers take saved passwords and session cookies from employees' browsers, sometimes on personal devices the company does not manage. The stolen data is then sold as "stealer logs." An attacker with those logs can sign in to web-facing work systems without touching the internal network first. A joint FBI and CISA advisory on the LummaC2 stealer (AA25-141B) lists financial credentials and multi-factor authentication details among the data it targets.
- Taking over cloud accounts and moving into connected services. Sophos X-Ops recently described an unrelated intrusion. The attacker phoned staff while posing as the help desk, abused the company's self-service password reset to take over a Microsoft 365 account, and used that account to reach SharePoint, Salesforce and ServiceNow. From one compromised account, the attacker downloaded nearly 100,000 documents and exported about 2,500 user records. Sophos's point is that once an attacker controls one identity, every connected business application becomes a source of data.
Until SM or the Korean authorities release findings, the actual entry point is unknown.
What Organizations Should Do
- Treat approval and HR document systems as sensitive data stores. List what personal data sits in attachments in your electronic approval, HR and contract systems. Remove or redact national ID and bank numbers from documents wherever the process does not need them, and set retention limits so old files are deleted.
- Audit and rotate access keys, API tokens and service accounts. SM's step of replacing "unauthorized access keys" suggests a credential was abused. Keep an inventory of long-lived keys used by business systems, tie each one to a named owner, rotate them on a schedule, and alert when one is used from an unfamiliar IP address or in an unusual pattern.
- Watch for bulk document access and downloads. Set alerts for any single account opening or exporting large numbers of approval documents or attachments, especially outside normal hours or from new locations. Both SM's detection and the Sophos case depended on noticing unusual access volume.
- Separate subsidiaries on shared platforms. If group companies share one work system, enforce strict separation between companies and give each one its own logging, so one compromised account cannot reach every company's records.
- Close the infostealer and help-desk gaps. Monitor stealer-log feeds for corporate domains and reset any credentials and sessions that turn up. Limit access to work systems from unmanaged devices. Require stronger identity checks before help-desk password or MFA resets, and use phishing-resistant MFA for anyone with access to HR or approval data.
- Warn affected staff and partners about impersonation now. Tell employees, artists and partners exactly how the company will and will not contact them. Publish official channels for copyright and legal notices. Remind everyone that the company will never ask for bank details or ID numbers by phone or text.
Sources: SM Entertainment Apologizes for Data Breach Exposing Employees' Per... | Beyond the mailbox: Graph reconnaissance and ServiceNow user enumer... | SM Entertainment Says Employee National ID and Bank Data Leaked in... | Comedian Chung Ju-ri fell victim to an email impersonating SM Enter... | Infostealers: how employee passwords end up in leaks | Data, on the House The Breach Brief | Hacker leaks SM Entertainment workers’ data in South Korea breach -... | SM엔터 계열 3사 임직원 개인정보 유출…계약서 정보까지 털려 :: 공감언론 뉴시스 ::