A warning, not a verified theft of KLPGA member records
On 30 October 2026, the Korea Ladies Professional Golf Association (KLPGA) issued a notice about a possible personal-data exposure involving Douzone Bizon, which supplies its accounting software. The association received the vendor's alert on 29 October. The incident concerned the APO backup service; the KLPGA warned members while the scope was still under investigation.
The distinction matters: a possible exposure is not confirmation that KLPGA members' records were stolen. The association has not established whether its own information was included in affected files, which individuals might be involved or how many people could be impacted. No confirmed victim count has been released.
What the warning actually says
According to the notice, the software provider reported signs that some encrypted data may have been transferred away from a backup server. It said there was no indication that encryption keys had been extracted. Removing encrypted files is not automatically equivalent to obtaining usable personal information, although the incident still requires investigation.
Potential categories of KLPGA information include members' names, Korean resident-registration numbers and addresses. These are possible types of data, not a confirmed inventory of stolen records. It would be wrong to say that every professional golfer, or a named athlete, had her information disclosed.
Why professional golf is affected by a supplier incident
There is no confirmed attack on a KLPGA tournament leaderboard, a scoring system or the association's public website in this report. The concern stems from third-party corporate accounting and backup infrastructure. Sports bodies must retain administrative and membership records outside their public competition platforms; cybersecurity risks can therefore reach them through external service providers.
On 26 October, Segye Ilbo reported that South Korea's Ministry of Science and ICT had classified the wider Douzone Bizon breach as serious and initiated a joint public-private investigation on 25 October. The vendor had notified the authorities about incidents on 16 and 21 October. That broader investigation predates the KLPGA notice and does not itself prove KLPGA information was taken.
What happens next
The KLPGA advised members to be vigilant about unexpected calls, texts, emails, suspicious links and requests for personal details. It has asked the provider to clarify whether association records were affected and promised additional information and protective action when facts are verified.
The supported conclusion as of 1 November is limited but important: the KLPGA has issued an official warning related to a supplier security incident; actual exposure of KLPGA member data has not been confirmed. Verified new findings should update this report rather than generate a duplicate story.
Sources: Official KLPGA notice, 30 October; DailySecu, 31 October; Segye Ilbo, 26 October.
