HYBE fan platform Weverse payment API accessed abnormally, leaking purchase and refund records of over 422,000 accounts

Weverse, the fan platform of South Korea's HYBE, said that on September 3 the Korea Internet & Security Agency told it an outside party had reported a vulnerability, and an inspection confirmed data of 422,584 accounts leaked ^[1]. The data consists of internal identifiers and transaction details such as payment method, payment gateway, currency, purchase and cancellation amounts and purchase and refund times; the company says the identifiers cannot be used externally, payment forgery from them alone is unlikely, and it has tightened access control on its payment information API ^[1]. Operators of external APIs should review endpoint access control and minimize returned internal identifiers, and Weverse users should watch for individual notices ^[1].

Industries mainly affected: Media, entertainment & gaming

1. Weverse users should watch for the company's individual notices ^[1].
2. Operators of external APIs should review access control and remove unneeded internal identifiers from responses .