SM Entertainment has disclosed that an outside attacker gained unauthorized access to its business systems and removed documents containing personal information. The company said the incident occurred around November 4 and was detected through internal security monitoring. The affected systems included an electronic approval platform used for company work.
The exposed information may include employees’ names, mobile phone numbers, addresses, bank account numbers, resident registration numbers, department details, job titles and information recorded in contracts. The precise combination differs by person, according to the company. SM is identifying the affected individuals and data fields and notifying people separately by email or text message.
Affiliates confirm similar unauthorized access
Similar incidents were confirmed at two affiliated companies. Dear U, which operates the Bubble fan communication platform, and concert organizer Dream Maker Entertainment were also affected. The available disclosures do not provide a total number of people whose records were exposed, and they do not establish that every listed category of information was compromised for every affected person.
- Incident timing
- Around November 4
- Affected organizations
- SM Entertainment, Dear U and Dream Maker Entertainment
- Confirmed secondary harm
- None identified at the time of the notice
SM said it blocked the internet addresses and access routes used in the attack after discovering the intrusion. It also replaced the unauthorized access key to prevent further entry and data removal. The company is working with government authorities and outside security specialists to investigate the incident, review its security controls and strengthen access restrictions and monitoring.
No secondary harm caused by misuse of the exposed information had been confirmed at the time of the company’s notice. SM nevertheless urged affected people to watch for voice phishing, fraudulent text messages and contacts impersonating trusted organizations. It also advised caution with unfamiliar links and attachments. Because the exposed categories include identity and financial information, individual notifications will be central to showing which people and records were affected while the investigation continues.