Weverse

Weverse leaked internal user IDs and purchase metadata for 422,584 accounts through an unnamed flaw in its payment information API, a flaw an external reporter found before Weverse did. The company's own inspection began only after KISA flagged it on September 3, confirming that the data already sat with an outside actor. Strengthening access controls after the leak is not a fix; it is an admission of what the API was never built to secure from the jump. No names, no contact details, only the payment trail attached to every one of those customers' accounts.