Loading story…
HYBE-operated fan platform Weverse disclosed unauthorized exposure affecting 422,584 user accounts after the Korea Internet & Security Agency (KISA) alerted it to a service vulnerability. Exposed information included Weverse-only internal identifiers and transaction-related data; the company said the identifiers cannot be used outside its platform.
Weverse reported the incident to KISA, notified affected users, and tightened access controls on its payment-information API while removing exposed internal identifier data. The company said it will review externally exposed APIs and deployment procedures and pursue legal action against the external actor it holds responsible.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
Weverse submitted a breach-incident report to KISA containing its inspection findings and response status.
The Korea Internet & Security Agency (KISA) notified Weverse of a security vulnerability in its service that had been reported by an external party. Weverse began an investigation with external cybersecurity experts.
Following the incident, Weverse strengthened access controls for its payment-information API, removed internal identifier information from the affected API exposure, and separately notified affected customers.
Weverse's investigation confirmed that confidential information associated with 422,584 accounts was exposed, including internal user identifiers and transaction-related information. The company said the internal identifiers could not directly identify individuals or be used outside the platform.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
teiss.co.uk
Open sourcemalware.news
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
VRChat disclosed that unauthorized access to its cloud environment exposed data belonging to **2,436,782 users** after an intrusion between May 10 and May 12. According to the company’s filing, the compromised information included VRChat usernames, associated email addresses, **VRChat+** subscription status, login history, device and hardware identifiers, IP addresses, and linked **Steam** or **Meta** user IDs. VRChat said passwords, payment card data, and government ID documents used for age verification were not believed to be affected. The company said it contained the incident, added security controls, and brought in external security experts to monitor for further threats. The breach raises immediate risks of phishing, account targeting, and credential-stuffing attempts against users who may have reused passwords on other services, while linked platform identifiers could enable broader identity correlation. Reporting also noted that VRChat disclosed the incident through a filing with Maine’s attorney general rather than a broad public announcement, and it did not offer identity theft or credit monitoring services.
Jun 29, 2026
Attackers gained unauthorized access to a third-party customer service system used by Discord, resulting in the exposure of sensitive user data. The breach, which occurred on September 20, 2025, did not compromise Discord’s core infrastructure but targeted a helpdesk provider that managed customer support and Trust and Safety interactions. The attackers obtained personally identifiable information, including real names, Discord usernames, email addresses, and IP addresses of users who had contacted Discord’s support teams. In addition to contact details, the breach exposed partial payment information, such as the last four digits of credit cards and payment types, as well as purchase history for some users. Notably, a subset of affected users had submitted government-issued identification documents, such as driver’s licenses and passports, for account appeals or age verification, and these scanned IDs were also accessed by the attackers. The attackers demanded a ransom from Discord, threatening to leak the stolen information if their demands were not met, indicating a financially motivated campaign. Discord responded by immediately revoking the support provider’s access to its ticketing system, launching an internal investigation, and engaging a leading computer forensics firm to assist with remediation. Law enforcement agencies were also notified and involved in the investigation. The company publicly disclosed the incident and notified affected users, emphasizing that full credit card numbers and account passwords were not compromised. The breach highlights the risks associated with storing sensitive data, such as government IDs, in third-party systems, especially as regulatory requirements push platforms to collect more personal information for age verification. Security experts note that customer support platforms often become attractive targets for cybercriminals due to the concentration of sensitive user data. The incident underscores the importance of minimizing data retention and ensuring that sensitive information is not stored longer than necessary in support systems. Discord’s experience mirrors previous breaches at other major platforms where helpdesk systems were exploited to access user data. The company’s swift response aimed to contain the breach and prevent further unauthorized access. The exposure of government-issued IDs is particularly concerning, as it increases the risk of identity theft for affected users. The breach serves as a cautionary tale for organizations relying on third-party vendors to handle sensitive customer interactions. Ongoing investigations are expected to provide further insights into the attackers’ methods and the full scope of the compromised data. Discord has committed to reviewing and strengthening its data handling and vendor management practices in the wake of the incident.
Jun 29, 2026
Healing Paper disclosed that unauthorized, abnormal access to an API used by its Gangnam Unni beauty-medical platform exposed personal data belonging to 219,665 domestic and international users. The company detected access to a consultation-record retrieval API, blocked the identified route, and said the same attacker attempted to use another route the following day; no responsible threat actor has been identified. The affected users include roughly 160,000 people in South Korea, 48,000 in Japan, and 4,218 in Taiwan. Potentially exposed information includes account and device details alongside highly sensitive consultation, treatment, payment, visit, procedure, and patient-photo data, creating material privacy, fraud, and extortion risk for affected individuals.
Sep 7, 2026