According to HYBE's notice (posted Oct 18, reported by Yonhap and others on Nov 2), an internal security inspection found signs of "abnormal external access" to an outside vendor's document preview solution connected to its electronic approval system. A follow-up investigation found similar access to its expense-processing system. The access happened on Sept 12-13 and Oct 3-5.

• What leaked: internal documents from the two systems containing names, resident and alien registration numbers, passport numbers, bank account and card numbers, phone numbers, email and home addresses, medical information, dates of birth, employee numbers, department names and IP addresses. The fields differ per person, and HYBE says it told each person what was exposed. It has not said how many people are affected.
• Response: HYBE blocked the attackers' IP addresses and access routes, reported to KISA and the Personal Information Protection Commission, and says no misuse has been reported. It warned staff about follow-on phishing impersonating its departments.
• Context: its affiliate Weverse Company separately disclosed a Sept 6 leak involving data linked to 422,584 fan-platform accounts.

Takeaway: document-preview and conversion add-ons bolted onto approval or ERP systems see every attachment, so they deserve the same patching, authentication and access logging as the core system, plus alerts on bulk document retrieval.