HYBE data breach: employee medical records, financial details exposed
Severity: high · Patch status: no-fix-needed · Since 2026-10-18
HYBE, the South Korean entertainment agency behind BTS, disclosed a cyberattack detected during an internal security inspection that exposed personal information of current and former employees and business partners. Exposed data reportedly includes resident registration numbers, credit card numbers and medical records. The company posted an apology on its website on Oct 18, 2026. Details on the attack vector, attacker identity, number of affected individuals and remediation steps have not been disclosed. Affected individuals face risks of identity theft, financial fraud and privacy violations from the sensitive medical and financial data exposure.
What to do
- Monitor for identity theft and financial fraud if you may be an affected employee or partner
- Watch for HYBE notifications and any identity-theft protection or credit monitoring offered
- Review credit card statements for unauthorized charges
- Be alert to phishing leveraging the leaked personal data
Sources
All live incidents on Threat Watch