SM Entertainment has confirmed that an external attacker broke into its business systems and leaked documents containing employees' personal information, including resident registration numbers and bank account numbers. The company disclosed the breach in a notice on its official website on 8 November 2026.

According to SM, the attacker gained unauthorised access to systems including its electronic approval system during internal security monitoring, and sent some stored document files outside the company. The company said the incident occurred around 4 November.

The leaked material includes names, mobile phone numbers, home addresses, bank account numbers, resident registration numbers, department and job-title details, and some information recorded in contracts. SM said the exact items leaked vary from person to person, and it is identifying those affected and notifying them individually by email or text message.

The breach also affected two affiliates, DearU, the company behind the fan communication app Bubble, and concert production house Dream Maker Entertainment, which reported similar leaks of personal data. SM said it has not confirmed whether the personal information of affiliated artists or general fans was included.

SM said it immediately blocked the IP addresses and access routes used in the attack and replaced the unauthorised access keys to prevent further leaks. The company added that, as of now, no cases of secondary harm from misuse of the leaked information have been confirmed, and it apologised to those affected.

The exact number of people affected has not been disclosed. The incident follows a data leak disclosed by rival agency HYBE days earlier, underlining a difficult week for South Korea's entertainment industry.