Weverse Hit by Data Breach Affecting More Than 420,000 Accounts

HYBE's fan platform Weverse has confirmed a data breach affecting more than 420,000 user accounts. The company said the exposed data included internal identifiers and payment-related information, but not names, phone numbers or other information that could directly identify users.

Weverse Company, which operates the platform, disclosed the breach on Sept. 6. The company said it launched an immediate investigation after receiving notice of a reported security vulnerability and confirmed that some user data had been exposed.

"We sincerely apologize for causing concern to the fans who have trusted and supported Weverse," the company said.

According to Weverse Company, the Korea Internet & Security Agency (KISA) notified it on Sept. 3 that a third party had reported a security flaw in the platform. The company subsequently conducted an internal review and launched an emergency response, determining that 422,584 account IDs had been affected.

The exposed data included identification numbers generated internally when users created their accounts. It also included transaction records that the company said are not classified as personal information under Korean law. The records covered payment methods, payment gateway providers, currencies such as the Korean won, purchase and cancellation amounts, transaction dates and times, purchase statuses such as "COMPLETE," and refund dates and times for canceled transactions.

Weverse Company said it has tightened access controls for its payment-processing API and removed internal identifiers from externally accessible data. It submitted a formal breach report to KISA on Sept. 4 detailing the findings of its review and the measures taken in response.

The company stressed that the exposed identifiers cannot be used outside its systems.

"The exposed internal identification data does not include information that directly identifies individuals, such as names or contact details," the company said. "It consists of identifier values used only within Weverse Company's internal systems and cannot be used externally."

The company added that the exposed data alone would be unlikely to enable fraudulent payments or unauthorized transactions.

Weverse Company plans to audit all externally accessible APIs, strengthen access controls and limit the amount of information they expose. It will also tighten controls over its deployment process and enhance security monitoring.

The company said it has asked the outside party that obtained the data through unauthorized access to return it. "We will pursue legal action over this incident," it said.

Weverse hosts official fan communities, livestreams and paid content for artists from HYBE and other entertainment agencies.