ENKR

Weverse leak of internal user IDs and purchase records

Add to my breach check

Made public · 422,584 accounts

What leaked2

Hard to replace

  • Other profile data

Permanent

  • Purchase or order history
  • Purchase or order historypayment method, payment gateway, currency, purchase and cancelled amounts, purchase time, status and refund time · the company says these are not personal data on their own
  • Other profile datainternal user number that Weverse creates at sign-up; not a name or contact detail

To-dos

None of the harms this check covers.

What happened next6 events

  1. UndetectedNone on record
  2. Response 6 eventsNo individual notice on record · show events
  3. RemedyNone on record
  4. PenaltyNone on record
  5. DisputesNone on record
  1. The CEO apologised in the notice
  2. Notice on Weverse Shop: 422,584 accounts; internal user number and purchase records; the company says the items alone make payment fraud unlikely
  3. Reported the incident to KISA with its findings and response
  4. KISA told the company that an outside reporter had found a security flaw in Weverse; the company checked and found a leak
  5. Affected customers told separately, as the law requires
  6. Tightened access control on the payment API and removed the internal user number from it
Company
Weverse
Company detected it
Made public
Notice
Leak confirmed
Affected
422,584 accounts · counted by account ID; company notice

How the facts developed

  1. Company notice: after KISA passed on an outside report of a security flaw on September 3, 2026, Weverse Company found that internal user numbers and purchase records of 422,584 accounts had leaked

Sources