SockAnalystHYBE breach: hackers got in through a vendor's document-preview tool
SockAnalyst · Security+ certified analyst.
What happened
HYBE, BTS's label, says attackers got in through an outside vendor's document preview software linked to its electronic approval system. Breaches happened Sept 12-13 and Oct 3-5. Exposed data includes resident registration numbers, credit card numbers, medical records, passport numbers, bank details, addresses and phone numbers. HYBE hasn't said how many people were affected and reports no misuse so far.
Who's affected
Current and former HYBE employees and business partners in Korea.
✅ Fix / patch
- Inventory third-party plugins (document viewers, previewers) wired into approval, HR and ERP systems, and check how they authenticate.
- Review vendor plugin logs for bulk document access.
- Expect HR- and finance-themed phishing aimed at HYBE staff and partners.
🔎 Quick hunt check
No published indicators. Look for unusual bulk reads through document-preview or viewer service accounts on approval and expense systems.
MITRE ATT&CK: T1199, T1190, T1213, T1567
IOCs
No IOCs (IPs, domains or hashes) published by the sources yet.
Hunt queries
Starting points built only from published indicators. Field names vary; tune before use.
index=web (uri_path="*preview*" OR uri_path="*viewer*" OR uri_path="*docview*")
| bin _time span=10m
| stats count dc(uri) as docs by _time, src_ip, user, dest
| where docs > 50// Bulk document reads through preview/viewer endpoints (W3C IIS or WAF logs)
W3CIISLog
| where csUriStem has_any ("preview","viewer","docview")
| summarize Requests=count(), Docs=dcount(csUriStem) by bin(TimeGenerated,10m), cIP, csUserName
| where Docs > 50⏱ CISA deadline
Not in CISA KEV as of Nov 14, 2026.
Sources
Primary source note: HYBE posted its own notice on its website on Oct 18, but we could not locate a stable public URL for it; sources below quote it.
Related playbooks
- DreamHost File Manager breach: FTP/SFTP passwords and some webmail sessions stolen · Breach · 2026-11-06
- Amadeus airline booking breach hits JAL, ANA, Cathay, Singapore Airlines and others · Breach · 2026-10-28
- Chainalysis discloses breach of customer contact data · Breach · 2026-10-30
Get the Weekly KEV & Hunt Pack free — plus the daily SOC brief.
Weekly email; daily brief on the website.
Subscribe free