According to Weverse Company, the issue was first flagged not by its own security team, but by an external party who reported a vulnerability to South Korea's Internet & Security Agency (KISA) on September 3. Weverse launched an internal investigation within hours, filed a formal breach report with KISA on September 4, and began notifying affected users individually by September 6.
What actually leaked?
The exposed data centers on two things: an internal account ID number assigned to each user, and transaction-related metadata tied to purchases made on the platform — things like payment method, payment amount, currency, purchase date, and refund status. Weverse has been clear that names, phone numbers, emails, passwords, and full payment card numbers were not part of this leak, and that the internal ID numbers "cannot be used externally" on their own.
That's genuinely reassuring on the surface. But purchase histories and payment metadata are still sensitive. Security-minded fans have pointed out that this kind of data can be used to craft convincing phishing messages ("confirm your recent Weverse order") or to partially re-identify users if combined with data from other breaches down the line.
Not the platform's first data scare this year
This isn't Weverse's only data controversy in 2026. Back in January, CEO Choi Joon-won publicly apologized after a Weverse employee was found to have improperly accessed and leaked personal data — names, birthdates, and phone numbers — tied to a fan-event winners list. That employee was fired and reported to law enforcement, and affected users were compensated with roughly ₩100,000 (about $69 USD) in platform credit.
The two incidents are technically different — January was insider misuse, September is an external API exploit — but together they paint a picture of a platform that's had real trouble locking down user data twice in one year. Adding to the pressure, Korean streaming service Tving disclosed an unrelated but far larger breach (roughly 39.5 million accounts) the very same weekend, putting data security across Korea's entertainment platforms squarely in the spotlight.
What should fans do?
If you use Weverse, check your email and in-app notifications to see if you were among the affected accounts. Review your purchase history for anything unfamiliar, be skeptical of any message referencing your Weverse order details, and consider updating your password as a precaution — even though passwords weren't confirmed to be part of this specific leak.
What happens next?
Weverse says it has already secured the vulnerable API, removed internal ID data from externally exposed endpoints, and is auditing its other APIs for similar issues. The company also says it plans to pursue legal action against whoever accessed the data. Whether regulators impose fines under Korea's data protection law, or whether affected fans see compensation similar to January's payout, remains to be seen.
For fans keeping tabs on their favorite groups' platform, this is a story worth watching — not because of catastrophic financial exposure (there's no confirmed fraud tied to this breach yet), but because of what it says about how well Weverse is actually protecting the fandom data it collects.
Want the full breakdown — including the complete timeline, exactly what data categories were exposed, and how this compares to Weverse's past incidents? Read the full deep-dive on kpopfam.com.