Weverse Payment Metadata Breach Affected 422,584 Accounts

The Weverse payment metadata breach affected 422,584 accounts, Weverse Company confirmed. The company said that the South Korean Korea Internet & Security Agency (KISA) alerted it to a possible vulnerability on September 3. After investigating, it found that internal user identifiers and data related to purchase transactions had been obtained without authorization.

The company reported the incident to KISA on September 4 and, according to its notice, has already sent individual notifications to affected customers. It also announced legal action against an external actor who allegedly obtained the data without authorization.

Weverse payment metadata breach: What data was affected

The exposed data included an internal numerical user identifier and transaction metadata. This mainly consisted of the payment method, payment gateway name, currency, purchase and cancellation amounts, transaction times and statuses, and any refund date.

Weverse also said that names and contact information were not exposed and that the exposed items themselves should not enable payment forgery or unauthorized transfers. The company did not confirm the exposure of payment card numbers, banking information, or passwords. Describing the incident only as a leak of “payment records” could therefore be inaccurate if it suggested that payment credentials were compromised. What has been confirmed is transaction metadata, not login or card data.

The assessment of the risk of financial misuse is currently based mainly on Weverse’s statements; independent technical findings about the scope of the exposure and subsequent handling of the data are not publicly available.

Payment API change and missing technical details

The case involved an API that processes payment information. Weverse said it tightened access controls for the interface and removed internal user identifiers from it.

However, the company did not publish a technical description of the vulnerability. It has not been independently confirmed who exploited the flaw, how long access to the data may have been available, or whether the data obtained was further distributed or misused. It is also unclear whether the investigation will identify additional affected accounts or data categories.

What this means for Weverse users

Weverse says that names and contact information were not among the exposed data. Combined with purchase information, however, the breach could provide material for more convincing targeted phishing messages, such as messages referring to a specific currency, refund, or payment method.

Affected customers should therefore pay attention to individual notifications from Weverse and carefully assess messages posing as communications from the platform, a payment gateway, or customer support. They should not enter login credentials, card numbers, or one-time verification codes through links in unsolicited messages. Weverse itself did not confirm the exposure of passwords or card data in its available statement.

What comes next

Any findings from a review by KISA or another competent authority will be important. Weverse may also provide more details about the flaw, the period of possible exposure, and whether it detected any further use of the stolen data. For now, this is a confirmed incident involving more than 420,000 accounts in which the company says it has implemented remedial measures, but has not disclosed key technical circumstances.

Verified and updated: September 7, 2026 06:22