SM Entertainment Hacked, National ID and Bank Account Details Exposed

SM Entertainment has confirmed that personal information was leaked in a cyberattack and has issued a public apology. The leaked information includes names and phone numbers, as well as highly personal data such as resident registration numbers and bank account numbers.

The company announced the data breach and its response measures in a notice posted on its official website on Nov. 8.

"During recent internal security monitoring, we confirmed that an external attacker gained unauthorized access to our business systems, including our electronic approval system, and leaked some of the documents stored there," SM Entertainment said.

According to the company, the breach occurred around Nov. 4. The leaked information includes names, mobile phone numbers, addresses, bank account numbers and resident registration numbers, which serve as national identification numbers in South Korea. Department names, positions, job titles and information contained in contracts were also among the affected data.

The types of information leaked vary by individual. SM Entertainment said it is still working to identify exactly who was affected and which information was exposed. The company is notifying affected individuals through email or text messages as it confirms the details. The total number of people affected has not been disclosed.

After discovering the breach, SM Entertainment blocked the IP addresses and access routes used by the attacker. It also replaced the access key used to gain unauthorized entry. The company is investigating the incident with the relevant authorities and plans to work with outside security experts to review its security systems.

SM Entertainment said it has not identified any cases of the leaked information being misused so far. However, the company warned affected individuals to remain cautious about potential secondary fraud, including phone and text-message scams.

The company advised people to be wary of calls, texts or emails from anyone impersonating SM Entertainment or its representatives, particularly those requesting money or personal information. It also urged people not to click suspicious links or open attachments from unknown senders.

Anyone who suspects they have been affected or has questions about the breach can contact a dedicated support desk operated by SM Entertainment's Technology Information Committee. The company also said individuals who suffered losses as a result of the breach may seek compensation under South Korea's Personal Information Protection Act or apply for mediation through the Personal Information Dispute Mediation Committee.

"We take this incident very seriously," SM Entertainment said. "We will further strengthen access controls and security monitoring for our internal systems and do our utmost to prevent similar incidents from happening again through a thorough investigation into the cause and improvements to our security systems."

"Once again, we sincerely apologize," the company added.