SM Also Hacked... Major Music Agencies' E-Approval Systems Breached After HYBE

Resident Registration Numbers and Contract Information Leaked from SM and Affiliates
HYBE Breached Through an External Document Preview Program
Access to Work Systems Under Scrutiny After a Series of Incidents

SM Entertainment's headquarters in Seoul. Photo provided by SM.

Resident registration numbers, bank account numbers, and information contained in contracts were leaked from the work systems of SM Entertainment and its affiliates. Last month, it was also revealed that HYBE's electronic approval system and expense processing system had been hacked. As internal work documents have been leaked in a series of incidents at major music agencies, the management of access to personal information has emerged as a key issue.

According to industry sources on November 9, SM announced on its website on November 6 that personal information had been leaked. An internal security review confirmed that an external attacker had gained unauthorized access to work systems, including the electronic approval system, and extracted some documents. The incident is believed to have occurred around November 4.

The leaked information included names, mobile phone numbers, addresses, resident registration numbers, bank account numbers, affiliated departments and positions or titles, and information listed in contracts. SM is identifying the affected individuals and the leaked information and is notifying them individually by email or text message.

Regarding whether the personal information of its artists had been leaked and the total scale of the damage, SM said it was "currently investigating the details and extent of the leak." It added, "So far, we have not confirmed any cases of secondary harm resulting from the misuse of leaked personal information," and urged people to "be cautious of messages from anyone impersonating the company or its affiliates and requesting money or financial information."

Immediately after confirming the incident, SM blocked the internet protocol (IP) addresses and access routes used in the attack and replaced access keys. The company is investigating the circumstances of the incident with the relevant authorities and plans to review its security systems with external specialists.

Damage was also confirmed at an affiliate. Concert promoter Dream Maker Entertainment announced that some documents had been leaked from its work systems, including its electronic approval system, around the same time. The leaked information included resident registration numbers, bank account numbers, and details listed in contracts.

DearU, the operator of the fan communication app Bubble, said an external attacker had infiltrated a work system operated by another affiliate, resulting in the leak of employee information. The leaked information included names, dates of birth, employee numbers, email addresses, departments and job grades, and dates of hire. DearU is investigating the scope of the damage with the affiliate that operates the system.

SM said, "No fan information was leaked, and we have reported the incident to the relevant authorities, including the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission." It added, "We take this incident very seriously," and said, "We will do our utmost to prevent similar incidents from happening again by further strengthening access controls and security monitoring for our internal systems, thoroughly identifying the cause, and improving our security systems."

HYBE headquarters in Seoul. Yonhap News.

HYBE announced on its website on October 18 that internal documents and personal information had been leaked in two incidents, on September 12-13 and October 3-5. The company detected signs of abnormal access through a document preview program provided by an external vendor connected to its electronic approval system. A further investigation also found unauthorized access to its expense processing system using a similar method.

The leaked materials included the names, resident registration numbers, alien registration numbers, passport numbers, bank account numbers, card numbers, contact details, and medical information of current and former employees and partner company personnel. HYBE blocked the IP addresses and access routes used in the attacks and reported the incidents to KISA and the Personal Information Protection Commission. It individually notified those affected about the leaked information and set up a separate inquiry channel for former employees and partner company personnel whose contact details were difficult to verify.

The Gyeonggi Nambu Provincial Police Agency took over the case from the National Police Agency on November 3 and began a preliminary investigation before formally booking a suspect.

A personal information leak also occurred this year at Weverse Company, a HYBE subsidiary. On January 5, Weverse Company said an employee had shared the name and birth year of one fan sign event applicant, along with the names, dates of birth, and phone numbers of 30 winners of a public broadcast event, in a private KakaoTalk group chat. Weverse Company said, "The employee has been removed from their duties and referred to the personnel committee." 

On September 6, the company announced a separate data leak. The incident involved 422,584 accounts. Users' internal identification numbers, payment methods, purchase amounts and dates, and refund dates were leaked externally. Weverse Company classified internal identification numbers as personal information and payment-related records as general information. It said the leak did not include directly identifying personal information such as names or contact details.

Companies that handle personal information must grant system access only to the extent necessary for work and manage access logs. According to a guide to the "Standards for Measures to Ensure the Safety of Personal Information," published by the Personal Information Protection Commission on November 5, personal information controllers must retain records of access permissions granted, changed, or revoked for at least three years. They must also review access logs and download records for personal information in accordance with established procedures.

This content was produced with the assistance of AI translation services.