On 8 November 2026, SM Entertainment disclosed a data breach in which an external attacker entered its business systems around 4 November and removed stored document files. The files held employee identity and bank data, including resident registration numbers, bank account numbers, mobile phone numbers and addresses. Three companies in the group were affected: SM Entertainment, DearU and Dream Maker Entertainment. No victim count has been disclosed.
SM Entertainment is one of South Korea's largest entertainment agencies. SM said the leaked material covers members and partners of the group, and the exact scope and the people affected are still being assessed. Notifications go out individually, by email or SMS, as the company confirms what was taken from each person.
Leaked data
The notice lists employee identity and financial data. Its items are mobile phone numbers, addresses, bank account numbers, resident registration numbers, affiliations, and some information recorded in contracts. Which items leaked varies from person to person, because the attacker took stored document files rather than a single structured database table.
A resident registration number is South Korea's national identity number. It is used across government services, banking and employment. Unlike a password, it cannot be changed. A bank account number on its own does not empty an account, but paired with a name, address and phone number it gives a caller enough detail to impersonate the account holder. SM told affected people to watch for voice phishing and smishing from callers impersonating company officials. No disclosed leaked-item list mentions passwords, and no disclosure states whether passwords were affected.
The three companies disclosed different item lists, and the fuller list in the table comes from a summary of the three companies' disclosures. The DearU list comes from a secondary summary and is labelled as such.
| Company | Leaked items as disclosed |
|---|---|
| SM Entertainment | Names, mobile phone numbers, addresses, bank account numbers, resident registration numbers, department, position and title, some contract information |
| DearU | Names and English names, gender, date of birth, employee number, internal ID, email address, mobile phone number, department, position, title, rank, job duties, hire date |
| Dream Maker Entertainment | Same items as SM Entertainment, as reported in the summary of the three companies' disclosures |
Email addresses appear only in the DearU row. The claim comes from a summary of the three companies' disclosures, not from SM's own notice, and DearU's own notice was not read directly for this article.
Email addresses appear in only one row of the table. A summary of the three companies' disclosures reports that DearU's leaked employee database contained email addresses, with the caveat that the items actually leaked vary by individual. DearU's own notice was not read directly for this article, so the email claim is stated here as a secondary summary and kept separate from SM's own list. SM's own listed items do not include email addresses. The distinction matters: SM warned of voice phishing and smishing, and DearU employees' work addresses are in the leaked list, while the parent company's list is an identity and banking problem first.
The three companies
The breach reached beyond the parent company. DearU, the information technology affiliate behind Bubble, the fan communication app, confirmed a similar leak of personal data. Dream Maker Entertainment, the group's concert planning affiliate, confirmed a breach of the same type around 4 November. The disclosures describe the three leaks as part of the same incident, with the same intrusion reaching all three companies through the business systems they share. StarNews Korea reported that SM is identifying the exact individuals and items involved and notifying them individually.
SM stated that fan information was not leaked. The leaked DearU material is employee data from the affiliate's business systems, not fan data from the Bubble platform, and fans of SM artists are not named as affected people in any disclosure so far.
Notice and chronology
SM posted a notice on its website on 8 November 2026. It said recent internal security monitoring had confirmed that an external attacker gained unauthorised access to its business systems, including its electronic approval system, and sent stored document files outside the company. Seoul Economic Daily reported the notice the same day. Maeil Business News and Chosun Biz carried the same wording from the notice, and Edaily reported the same dates and the same apology.
SM put the leak at around 4 November 2026. The company said it is investigating the exact circumstances with the relevant authorities, and it apologised for the concern the incident caused. SBS reported at 20:13 KST on 8 November that SM described the leaked information as details of SM members and partners and said the exact scope was still being assessed.
Actions after discovery
SM said that as soon as it became aware of the incident, it blocked the IP addresses and access routes used in the attack and replaced the unauthorised access keys, and that the steps shut off further attacks and data leaks. Maeil Business News reported the same steps on 8 November. The company said it plans further measures: a detailed investigation in cooperation with government authorities and outside specialist agencies, and a review of its security systems.
SM also said no cases of secondary damage from misuse of the leaked data have been confirmed so far. That statement covers the period up to the disclosure on 8 November. isec.news summarised the same position: no secondary misuse confirmed, and the scope still being determined.
SM warned affected people to be cautious about voice phishing and smishing that impersonate company officials, a warning that matters because the leaked names, phone numbers and employer details give callers material to quote. Individual notifications are going out by email and SMS.
Regulatory reports
SM reported the incident to the Korea Internet and Security Agency (KISA) and the Personal Information Protection Commission (PIPC), South Korea's privacy regulator. SBS reported both reports on 8 November. The PIPC is the authority that investigates personal data breaches in South Korea and can order corrective measures, under the Personal Information Protection Act.
Sector context
HYBE, South Korea's largest music agency, disclosed a separate corporate leak on 2 November 2026. HYBE said attackers accessed its internal systems in two windows, 12 to 13 September and 3 to 5 October, through a document preview solution provided by an outside vendor and linked to its electronic approval system, and also through its expense processing system. The leaked items included names, resident registration numbers, passport numbers, bank account numbers, card numbers, mobile phone numbers, dates of birth and employee numbers. K-VIBE (Yonhap) reported the HYBE disclosure on 2 November.
The HYBE incident is not the SM incident: the dates, the entry points and the item lists differ, and no source links the two attacks. The parallel is limited to the sector and the system type. Both agencies held employee identity documents in business systems built around electronic approval, and both disclosed the leak days or weeks after the intrusion. SM has disclosed no attack vector. The HYBE vendor entry point belongs to HYBE, not to SM.
Measures for affected employees
The measures below cover the bank account, the resident registration number, phishing and email.
The first measure concerns the bank. Affected employees can contact their bank's fraud team, ask what extra checks can be placed on the account, and watch statements for transactions they did not make. The breach-response order of operations covers the sequence: find what leaked, fix reused passwords, expect phishing, then contain the next one.
The second measure concerns the resident registration number, which cannot be changed once it has leaked. The response is monitoring rather than replacement. Affected employees can watch for accounts opened in their name and for official mail about services they did not request.
The third measure concerns phishing. SM's own warning is the starting point: voice phishing and smishing impersonating company officials. A call or text that quotes the employee's name, employer and phone number is not verified by those details. Those details are the leaked data. Affected employees can reach the company through its published contact channels rather than through a number or link in a message about the breach. The guide to post-breach phishing describes how a leaked address and a leaked name turn a generic lure into a message that reads as if it came from the employer.
The fourth measure concerns email. It applies to DearU employees whose email addresses are in the leaked database. The risk is phishing that quotes the breach back at them. Affected employees can check whether their address appears in known breaches on Have I Been Pwned over the coming weeks, and change the password on any account that shares a password with the affected work account. The guide to checking a leaked email explains how to read each breach result and what to do for each one. The question of whether to change an email address after a breach is answered in the negative for most cases. The old address stays in the stolen copy. The work is containing the damage rather than moving the address.
Your address is probably in this file. Check whether it is, do the password work above, and then fix the part you control: the address you hand out next time. One AliasFleet alias per service means the next leak can only point back to the service that leaked it. Founders Club is $7 a month, locked forever, instead of $12. Early members only.
Open questions
The investigation is still open. SM said it is working with the relevant authorities and outside specialist agencies to identify the exact cause, and the scope of the leak is still being determined. The questions the investigation still owes are the number of people affected, the full list of documents removed, the entry point the attacker used, and whether the data was published or sold after it left the company.
No attribution has been made to any group. No ransomware or extortion demand has been reported in any disclosure so far. A follow-up article is warranted when SM publishes a victim count, names the entry point, or reports a finding from the PIPC investigation.
Top comments (0)