Weverse Company (HYBE) 2026 data breach

On 6 September 2026, Weverse Company, the HYBE subsidiary that runs the Weverse fan community and shopping platform used by K-pop fans worldwide, disclosed a data leak affecting 422,584 accounts. Company president Zooil Yang issued a formal apology to users.

The problem came to light on 3 September, when the Korea Internet & Security Agency (KISA) informed Weverse of a security vulnerability in the service that had been reported by an outside party. Weverse filed a breach report with KISA the next day and investigated with external security experts. The flaw sat in payment-related APIs that exposed internal user identifiers and transaction details.

What was exposed

The leaked fields were internal user identification numbers, purchase type, payment method and payment gateway name, currency, purchase and cancellation amounts, purchase dates and times, purchase status and refund dates. Weverse said names, contact details and card numbers were not part of the exposed data. The company tightened API access controls, removed internal identifiers from its payment APIs, notified affected customers individually and pledged to review all of its externally exposed APIs.

Context

It was the second data incident at Weverse in 2026, after an employee leaked personal information in January. It also followed a year of large South Korean consumer-platform breaches, including the compromise of 39.54 million accounts at streaming service Tving in June, which has kept regulators focused on the security of APIs behind popular apps.

Sources

musicbusinessworldwide.comhttps://www.musicbusinessworldwide.com/hybes-weverse-confirms-data-leak-affecting-422584-accounts-including-payment-and-refund-details/

soompi.comhttps://www.soompi.com/article/1868468wpp/weverse-notifies-users-of-data-leak

digitalmusicnews.comhttps://www.digitalmusicnews.com/2026/09/08/weverse-data-breach-2026/

Related incidents

Data breachContainedJune 3, 2026

TVING streaming platform breach exposes nearly 40 million accounts

South Korean streaming service TVING disclosed that an unauthorized party accessed member data; a later government investigation found that a stolen developer access key had exposed 39.54 million accounts and 361 technical assets including source code.

Victim: TVING (CJ ENM)

Data breachUnknownJuly 21, 2026

AI music platform Suno breach exposes 55 million user accounts (2026)

A breach at AI music generator Suno, made public in July 2026 via 404 Media and Have I Been Pwned, exposed more than 55 million user records.

Victim: Suno
Records: 55.3M

Data breachResolvedOctober 6, 2021

Twitch source-code and creator-payout leak

A server misconfiguration exposed Twitch's entire Git repository to an anonymous attacker, who leaked 125 GB of data — the full source code with commit history, internal tools, and three years of creator payout figures — as a torrent on 4chan.

Victim: Twitch (Amazon)

Data breachResolvedMarch 27, 2020

집꾸미기 data breach (2020)

In March 2020, the Korean interior decoration website ???? (Decorating the House) suffered a data breach which impacted almost 1.3 million members. Served via the URL ggumim.co.kr, the exposed data included email addresses, names, usernames and phone numbers, all of which was subsequently shared…

Victim: 집꾸미기
Records: 1.3M

Weverse payment API data leak (422,584 accounts)