Weverse has announced that it recently experienced a data breach that affected 422,584 user accounts.
On September 6, Weverse Company president Yang Zooil released a formal statement notifying users of a data security incident.
Hello,
This is Yang Zooil, President of Weverse Company.
Weverse Company recently received an external report regarding a security vulnerability in our service and immediately conducted an inspection. As a result, we confirmed that the personal information of some customers had been leaked.
We deeply apologize to all the fans who trust and support Weverse for causing great concern and worry through this incident.
Below are the details regarding the circumstances of this incident, the actions taken, and our future plans:
1. Scope of Leakage and Response Measures
On September 3, 2026 (KST), we were contacted by the Korea Internet & Security Agency (KISA), which informed us that an external reporter had reported a security vulnerability in the Weverse service. Following this, we immediately conducted an internal inspection and emergency response. The details of the personal data leak confirmed through the inspection conducted during this period are as follows:
Scope of Leakage: 422,584 cases based on account ID units
– Leaked Items:
- Personal Information Item: Internal identification information (a unique internal numerical value generated for user identification upon registration)
- General Information Items (not classified as personal information): Purchase type (payment method), payment gateway (PG) name, currency type (e.g., KRW), purchase amount, cancellation amount, purchase date and time, purchase status (e.g., COMPLETE), refund date and time (if purchase status is CANCELED)
As part of additional measures, we have strengthened security for the payment information processing API by enhancing access control and removing internal identifier information to prevent external exposure of data, and on September 4, we filed a breach incident report with KISA, including the results of our inspection and our response status.
In addition, in accordance with the criteria set forth by relevant laws and regulations, we have carried out a separate procedure to notify the customers affected by this leak of the fact of the leakage. The leaked internal identification information is not information that directly identifies an individual, such as a name or contact details; it is an identifier value used only within Weverse Company’s internal systems and cannot be used externally. It is unlikely that payment forgery or unauthorized fund transfers could occur based on these data items alone.
2. Security Enhancements and Future Plans
Going forward, we will conduct a full investigation of all externally exposed APIs to strengthen access control and minimize exposed information, and we will do our utmost to prevent similar incidents from recurring by tightening control over our deployment processes and enhancing the sensitivity of our security monitoring.
In addition, we have requested the retrieval of the relevant personal information from the external actor who illegally accessed it through an abnormal attack. We intend to pursue legal responsibility regarding the damage caused by this incident.
The Company takes full responsibility for this matter and will take all appropriate measures to address our customers’ concerns and worries. Once again, we sincerely apologize for the inconvenience caused to our customers.
Thank you.