SM Entertainment has confirmed that an external hacking attack exposed personal information belonging to its employees and related personnel, including resident registration numbers and bank account numbers, the agency said on Sunday.
The agency disclosed the breach on its official website on November 8, saying it discovered the intrusion during routine internal security monitoring. According to MK Sports, which first reported the disclosure, the attacker gained unauthorized access to the company’s business systems, including its electronic approval system, and exfiltrated stored document files.
SM said the leak occurred around November 4. The exposed information includes names, mobile phone numbers, home addresses, bank account numbers, resident registration numbers, departments and job titles, and information contained in contracts. Two affiliates were also affected: DearU, the operator of the global fan communication platform Bubble, and DreamMaker, the concert planning company.
The company said it moved immediately after discovering the breach, blocking the IP addresses and access routes used in the attack and replacing the unauthorized access keys. It added that it is working with government authorities and outside security specialists on a detailed investigation and a review of its security systems, and will take additional measures to prevent further harm.
No cases of the leaked information being misused have been confirmed so far, SM said, but the company warned those affected to stay alert for voice phishing and smishing scams that could exploit the exposed details.
“We are taking this incident very seriously,” SM said in its statement. The company said it will strengthen access control and security monitoring across its internal systems, conduct a thorough investigation into the cause, and improve its security framework to prevent a similar incident from happening again. It also offered a sincere apology to those affected.
The breach is a significant blow for one of South Korea’s largest entertainment companies. The intrusion reached internal business systems rather than fan-facing services: DearU operates Bubble, the messaging platform SM artists use to communicate directly with fans, while DreamMaker handles concert planning. That the leaked files include contract information and resident registration numbers — the highly sensitive national identification numbers used across Korean daily life — raises the stakes well beyond a typical corporate data incident, since such details can be used for identity theft and financial fraud.
SM said it will continue its investigation and take further steps as needed to protect those affected.
