Weverse Data Breach Exposes Data Tied to 422,584 Account IDs

PHOTO CREDIT: Weverse Company Inc. via Wikimedia Commons

Weverse has confirmed a data breach involving 422,584 account-ID records, exposing internal user identifiers and transaction information connected to purchases made through the platform.

According to an official notice, the HYBE-owned fan platform learned of a possible security vulnerability on September 3rd after being contacted by the Korea Internet & Security Agency. An internal investigation subsequently confirmed that customer information had been leaked.

The compromised data included numerical identifiers used within Weverse's systems, along with payment methods, payment gateway names, currencies, purchase and cancellation amounts, transaction dates, purchase statuses, and refund timestamps.

Weverse said names and contact information were not exposed. Passwords and complete payment-card details were also not included among the fields identified in the company's notice. The platform maintains that the leaked information alone is unlikely to allow fraudulent payments or unauthorized transfers.

In response, Weverse has strengthened access controls surrounding its payment-processing API and removed internal identifiers from externally accessible data. The company reported the breach to KISA on September 4th and has begun notifying affected customers where required by law.

Weverse said the information was accessed by an outside party through what it described as an "abnormal attack." The company has requested that the data be returned and intends to pursue legal action against the responsible party.

The platform, which combines artist communities with merchandise sales, memberships, and livestreaming, is used by fans of BTS, SEVENTEEN, and numerous other artists. Weverse said it will now review all externally exposed APIs, tighten its deployment procedures and expand its security monitoring.