WeVerse Data Leak Exposes Purchase Histories of 422,584 Fan Accounts
WeVerse, the fan-platform operated by HYBE, has confirmed a data leak affecting 422,584 user accounts — exposing purchase histories, payment method types, and internal identification details, but not card numbers, names, or contact information. Billboard
The platform published an official notice on its WeVerse Shop domain on September 6 confirming that some customers' personal information had been leaked, and apologised to affected fans. WeVerse Shop Notice The cybersecurity blog Bitdefender HotforSecurity subsequently reported that the breach involved 422,584 user accounts and detailed what information was exposed. Bitdefender HotforSecurity
According to reports cited by Billboard from Korea JoongAng Daily, WeVerse began an internal investigation after receiving a report from the Korea Internet & Security Agency (KISA), the country's national cyber-response body. WeVerse CEO Zooile Yang, who stepped into the role on June 1, replacing Joon Choi, stated that the company is individually notifying every customer impacted by the leak.
The scope of what was exposed is narrow but not trivial. Leaked data included payment method, currency type, purchase amount, purchase date and time, and internal identification information. Card numbers, customer names, and contact details were not among the affected data fields. An earlier report from the Korea Herald in January had described the leak as involving attempted internal access to fan identities and album purchase histories. Korea Herald
WeVerse launched in 2019 and hosts approximately 180 artist communities, including those for BTS, SEVENTEEN, TOMORROW X TOGETHER, and KATSEYE. The platform has 10 million active monthly users across 245 countries and regions, and surpassed 155 million cumulative lifetime downloads as of April. BTS alone accounts for more than 30 million community members, with near-daily posts keeping the platform's engagement high.
Beyond community features — including a direct-messaging option that lets fans message artists for $3.80 (5,100 won) — WeVerse operates WeVerse Shop, an e-commerce platform where fans buy albums, merchandise, and other artist products. It is the Shop domain where purchase records were held, and where the breach's exposure of payment method and purchase amount data originated.
In 2024, WeVerse turned its focus toward the U.S. market, seeking to expand beyond its K-pop base by onboarding artists such as Dua Lipa, Gracie Abrams, and Ariana Grande. The platform's growth ambitions now sit alongside questions about how securely it handles the transaction data that underpins its commercial operations.
For fans, the immediate practical step is to watch for direct notifications from WeVerse, which Yang said are being sent to each affected account individually.
