HYBE Weverse Data Breach: Purchase and Payment Data of 422,584 Accounts Exposed
Korean platform Weverse disclosed confidential data tied to 422,584 account IDs: purchase type, payment method, amounts, refund timestamps. Suspected access-control defect on the payment-info API. Company filed with KISA and hardened the endpoints.
Incident
Early September 2026, HYBE's global fan platform Weverse disclosed a data breach. Confidential data tied to 422,584 account IDs leaked. In the site advisory, Weverse said KISA notified the company on 3 September of a Weverse service vulnerability reported by an external party. Weverse then investigated with external security specialists. On 4 September, Weverse filed a breach report with KISA covering findings and remediation.
Technical details and scope
Weverse did not publish the exact bug class. Affected data:
- Internal identifiers and unique numeric IDs generated at registration
- Purchase type, payment method, payment name, currency
- Purchase and cancel amounts, purchase datetime, purchase status, refund datetime
The platform states credit card numbers, names, and contact details were not in scope. Leaked internal IDs cannot directly identify a person and are hard to use alone for payment fraud or unauthorized transfers. Field set matches what a payment-info API returns on transaction detail, not a user-profile table — points at an access-control defect on that API.
Impact
Weverse launched under HYBE in 2019. 155M+ downloads, ~10M MAU, 245 countries, ~180–200 artist communities. Field sensitivity is limited, but combined with spend history, payment channel, and purchase time it still feeds high-credibility phishing (fake order-exception / refund notices) and account-takeover attempts. Continues a Korean platform-breach streak: early September, medical-aesthetics platform Gangnam Unnie leaked ~220k domestic and overseas users; in July, telco KT was fined ~KRW 54 billion over user-data leaks and mobile-payment theft. Common weak point: access control on public APIs and mobile endpoints.
Remediation
- Audit access control on all external APIs. Minimize response fields. Do not emit internal identifiers.
- Identity-based access control and rate limits on payment/transaction APIs. Block unauthorized bulk fetch.
- Anomaly detection on API access: high-frequency, wide-range queries on one key or session should alert in real time.
- Shift security review into release and deploy. Regression-check interface changes for sensitive-data exposure.
- Users: treat Weverse order/refund/payment-exception email and SMS as suspect. Do not enter credentials off official channels.
Sources
- TEISS: Data breach hits Weverse, exposing confidential data of over 420,000 accounts
- WeVerse Data Leak Exposes Payment Data for Over 400,000 Users
- Related coverage: recent Korean platform user-data leaks