Data breach hits Weverse, exposing confidential data of over 420,000 accounts

Weverse, a South Korean digital communication platform, has disclosed a major data breach that exposed sensitive personal information belonging to more than 420,000 users.

 

Headquartered in Seongnam, South Korea, Weverse is a global fan community platform developed by entertainment company HYBE. It connects artists with fans worldwide, offering features such as direct interaction, exclusive content, community posts, and official merchandise.

 

In a data security incident notice on its website, Yang Zooil, President of Weverse, said that on September 3, the Korea Internet & Security Agency (KISA) notified the company of a security vulnerability in the Weverse service that had been reported by an external party. The company immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

While Weverse did not disclose the specific nature of the data security incident, it said an investigation confirmed that confidential information associated with 422,584 account IDs had been compromised. The affected data included internal identification information, a unique numerical identifier generated for users upon registration, purchase type, payment method, payment name, currency, purchase and cancellation amounts, purchase date and time, purchase status, and refund date and time.

 

“As part of additional measures, we have strengthened security for the payment information processing API by enhancing access control and removing internal identifier information to prevent external exposure of data, and on September 4, we filed a breach incident report with KISA, including the results of our inspection and our response status.

 

“Going forward, we will conduct a full investigation of all externally exposed APIs to strengthen access control and minimize exposed information, and we will do our utmost to prevent similar incidents from recurring by tightening control over our deployment processes and enhancing the sensitivity of our security monitoring,” Weverse said.

 

The fan community platform added that it had separately notified affected customers in accordance with relevant laws and regulations. It clarified that the leaked internal identifiers cannot directly identify individuals or be used externally, and are unlikely, on their own, to enable payment fraud or unauthorised fund transfers.

 

Furthermore, the company said it had requested that the external actor who illegally accessed the information delete and return the affected personal data. Weverse also confirmed that it intends to pursue legal action and hold the responsible party accountable for any damages resulting from the security incident.