Opening time: October 28, 2026, 10:22 GMT
Additional incidents of infringement of Bithumb, Daishin Securities, and Mirae Asset Management have been confirmed in Korea. Daishin Securities said that personal and credit information of 38,490 customers has been leaked, and Bithumb and Mirae Asset Asset Management are investigating or responding to abnormal external access, respectively. The Financial Supervisory Service is checking the scope of the incident and its response status.
The important thing is that the level of fact confirmed by the three companies is different. Checking for signs of intrusion, checking for breaches, and investigating the scope of the breach are not the same steps. Even if you tie the events together, it's only accurate if you look at the size of the damage and the path of attack separately.
| Confirmed breaches at the three financial firms
According to the contents confirmed by Yonhap News on October 28, it was additionally revealed that the infringement occurred in the virtual asset exchange Bithumb and the Daishin Securities and Mirae Asset Asset Management of the financial investment business right. It's attracting attention that security issues have arisen in different financial sectors. The Financial Supervisory Service understands the scope of incidents, such as sending inspection personnel to Daishin Securities.
However, it was not confirmed whether the companies were breached by the same attackers or exploited the same vulnerabilities. Just because multiple incidents were known at about the same time doesn't mean it's an organized attack. I need to divide up the attack path, the time of discovery, and the damage.
| Information leaked on 38,490 Daishin Securities customers
Daishin Securities announced that personal and credit information of 38,490 customers had been leaked. The company confirmed and reported the abnormal access of hackers on the server linked to the opening of a non-face-to-face securities account on October 17, and explained that it identified the leak in the investigation. This number is the size of the damage confirmed so far and should be distinguished from the results of further investigation.
Subsequent reports indicated that names, emails, addresses, and some account-related items were included in the breach. Depending on what information is in plain text or encrypted, the actual risk of abuse varies. It is important for the affected customer to check the items and protective measures that the company gives formal notice to.
| Bithumb groupware access and membership information research
In Bithumb, it was confirmed that there was abnormal access by an external unauthorized person to in-house mobile groupware. In the initial verification step, employee information leakage was known, and it was reported that an investigation was underway to see if membership information was even included. Therefore, we should not assume that the information of all members of the Bithumb Exchange has been leaked.
Groupware is a system for internal collaboration and business processing. It is important that the internal account or work-related information may be exposed, although the role is different from the trading system used by the customer directly. Companies need to check external access and check related permissions and access records.
| Initial response from Mirae Asset Management
Mirae Asset Management said it found signs of abnormal access to external IPs on some web systems and blocked access paths. The company is operating the emergency response system and investigating the cause and effect. According to the company's reported description, until then, there was no leakage of personal customer service information, and certain business system usage information was investigated.
In this situation, you have to distinguish between the traces of an attack and the actual data breach. The fact that there was an attempt to access is insufficient to interpret that the transaction history or asset information in the customer's account has been exited. When the results of the investigation are published, it is necessary to separately reflect the differences from the original description.
| Importance of API-linked server security
In the Daishin Securities Incident, a linked server related to the opening of a non-face-to-face account was mentioned. In financial companies, the apps and internal systems used by customers are linked to APIs, that is, the pathway through which data is exchanged between programs. The problem is that even if you don't directly infringe on the main trading system, your personal information may be exposed if the linked nearby services are weak.
It's not just the servers that are managed. Factors such as external access rights, authentication information, request history, minimum storage of sensitive information, and encryption must work together. The exact cause of the intrusion in this case cannot be concluded before investigation, but it shows the need to check the linked system.
| Protection measures to be confirmed by the affected customer
If you are subject to the leakage of Daishin Securities, it is better to check the official notice and damage response instructions provided by the company first. You should be wary of texts, emails, and contact asking for confirmation of personal information that impersonate a financial institution. It's because the second round of phishing that exploited the accident can be approached as if the attacker were an employee of a financial firm.
It's helpful to keep an eye on unfamiliar login reminders and account activity, even if it hasn't been confirmed that your account or login information has been directly misused. The password change and additional authentication settings can be determined according to the user's actual account security situation. It's safer to use official website or app instructions and not open links in suspicious messages.
| Standards for Financial Authorities Inspection and Disclosure of Accidents
The Financial Supervisory Service conducted an on-site inspection because the scope of the investigation does not end with the fact of the infringement. We need to find out which system the attack started on, what information was accessed, and if the danger remains after blocking. Each financial company has a different system structure, so it is difficult to sum it up into a uniform damage scale.
We need to distinguish this incident from previous reports of financial breaches. This time, it is a new fact that the infringement of the new company and the specific size of the breach of customer information of Daeshin Securities are additionally known. It's important for security technicians to distinguish between a simple re-report of the same incident and newly confirmed follow-up information on the size of the damage.
| Identifying causes and preventing recurrences
The final evaluation of these cases depends on the outcome of the investigation. The route of attack, the duration of the intrusion, the leaked information items, the privileges of the accounts involved, and the measures to prevent recurrence must be confirmed. In particular, it can become important whether there is sufficient access control between the employee work system and the customer information processing system.
The current figure is the leakage of information of 38,490 customers of Daishin Securities. If you express the damage of the rest of the company at the same level, you will distort the fact. In order to restore the security trust of financial institutions, it is necessary to disclose not only the discovery and notification of incidents, but also the results of investigations and concrete improvement measures.
To mitigate damage, we need to divide the risk by spill. Your contact information or email can be abused by impersonating financial institutions, and you need to make sure that your account information is included. The explanation that the information was encrypted must also check the encryption method and key management status to determine the actual level of protection. It's important for the affected customer to be specific about what data was exposed and what action to take. One-time company improvement measures like server replacement It should not only be a response, but also a method of constantly checking the linkage system and the access rights of external accounts.
References
Yonhap — Responding to breaches and authorities in 3 financial companies Yonhap News — Daeshin Securities and Mirae Asset Management Follow-up Damage Verification
