Key Takeaways
- • A hacker using an overseas IP address breached Mirae Asset Global Investments systems beginning around 7:11 p.m. on Oct. 22, with the Pension Fund Investment Pool website among the primary targets, according to an electronic financial breach report submitted to the Financial Supervisory Service.
- • The intruder logged into 307 member accounts using stolen password hash values and leaked user IDs, names, email addresses and encrypted passwords of 331 employees at corporate entities using the platform.
- • Approximately 960 megabytes of internal files, including market information, training documents and records of daily 2025 returns for fully entrusted funds, were downloaded from the pension pool site.
- • A separate breach of Mirae Asset's internal MGIS system exposed personal information on 2,281 people, including 1,715 employees at 31 overseas subsidiaries and 566 headquarters employees.
- • Mirae Asset did not detect the intrusion until Oct. 26, four days after the initial attack, and has confirmed no leakage of unique identification, credit or individual customer data and no financial damage.
Summary
A hacker targeted the website of the Pension Fund Investment Pool, a system under which idle funds held by government funds and public institutions are entrusted to professional asset managers for integrated management, during a cyberattack on Mirae Asset Global Investments, according to a breach report obtained by the office of Rep. Shin Dong-wook of the People Power Party from the Financial Supervisory Service on the 10th. Mirae Asset participates as a lead manager alongside Samsung Asset Management in the pool.
According to the report, the intruder accessed the pool website at around 7:11 p.m. on Oct. 22 from an overseas IP address. The hacker bypassed security controls by collecting internal URLs from an externally exposed web server status page, then queried member numbers sequentially to collect personal information and encrypted passwords. Between 12:43 a.m. and roughly 12:54 a.m. on Oct. 24, the intruder logged into 307 member accounts using stolen password hash values, exposing data on 331 employees at corporate entities that use the platform.
The hacker also downloaded internal government fund documents in sequence. From 11:36 p.m. on Oct. 23 until 2:23 a.m. the following day, about 960 megabytes of files were taken, including market information and training materials prepared by Mirae Asset and records of daily 2025 returns for fully entrusted funds.
A simultaneous attack on Mirae Asset's internal integrated business system, MGIS, involved the creation of 17 external accounts after the hacker bypassed email verification on Oct. 23, followed by exploitation of a user-information editing function to gain super-administrator rights. About 280 megabytes of internal documents were then downloaded, including disclosure and reporting materials for overseas subsidiaries filed with the regulator. Personal information on 2,281 people was leaked from MGIS.
Mirae Asset did not detect the breach until Oct. 26, when it identified the pool website attack around noon and the MGIS breach around 2 p.m. The company subsequently blocked overseas access, restricted vulnerable functions and reset account passwords. According to the report, no leakage of unique identification information, personal credit information or individual customer data, and no financial damage, has been confirmed.
According to the report, the intruder accessed the pool website at around 7:11 p.m. on Oct. 22 from an overseas IP address. The hacker bypassed security controls by collecting internal URLs from an externally exposed web server status page, then queried member numbers sequentially to collect personal information and encrypted passwords. Between 12:43 a.m. and roughly 12:54 a.m. on Oct. 24, the intruder logged into 307 member accounts using stolen password hash values, exposing data on 331 employees at corporate entities that use the platform.
The hacker also downloaded internal government fund documents in sequence. From 11:36 p.m. on Oct. 23 until 2:23 a.m. the following day, about 960 megabytes of files were taken, including market information and training materials prepared by Mirae Asset and records of daily 2025 returns for fully entrusted funds.
A simultaneous attack on Mirae Asset's internal integrated business system, MGIS, involved the creation of 17 external accounts after the hacker bypassed email verification on Oct. 23, followed by exploitation of a user-information editing function to gain super-administrator rights. About 280 megabytes of internal documents were then downloaded, including disclosure and reporting materials for overseas subsidiaries filed with the regulator. Personal information on 2,281 people was leaked from MGIS.
Mirae Asset did not detect the breach until Oct. 26, when it identified the pool website attack around noon and the MGIS breach around 2 p.m. The company subsequently blocked overseas access, restricted vulnerable functions and reset account passwords. According to the report, no leakage of unique identification information, personal credit information or individual customer data, and no financial damage, has been confirmed.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.