Key Takeaways
- • Mirae Asset Global Investments suffered a website hack in which attackers systematically guessed membership numbers one by one, exposing data tied to its public pension fund management business.
- • Leaked data includes IDs, names and emails of 331 users, market information and training materials, and daily returns of fully discretionary funds from last year.
- • Personal information of 2,281 executives and employees from overseas subsidiaries and headquarters was taken from an internal business system.
- • Mirae Asset had reported all 12 items as faultless in a self-security inspection requested by the Financial Supervisory Service two weeks before the hack.
- • Information on about 39,000 customers and employees at an affiliated securities firm was also leaked over two days starting on the 4th.
Summary
Mirae Asset Global Investments has suffered a hacking attack on its business website, which contains information on how it manages a portion of public pension funds, according to SBS News. The website hosts information for the Public Pension Fund Investment Pool, which compiles data on the management of surplus funds from the government and public institutions. Mirae Asset is the lead manager for about 38 trillion won of the 88 trillion won in public pension fund investment trust assets. The breach occurred last month and relied on a basic method in which the attacker repeatedly queried the system while systematically changing membership numbers until a match was found.
The attack exposed IDs, names and emails of 331 users, along with market information and training materials stored in the data archive. It also exposed the daily returns of fully discretionary funds from last year. Separately, personal information of 2,281 executives and employees from overseas subsidiaries and the headquarters was leaked from an internal business system. At Mirae Asset's affiliated securities firm, information on roughly 39,000 customers and employees was leaked over two days beginning on the 4th.
Mirae Asset had reported to the Financial Supervisory Service that all 12 items passed a self-security inspection requested by the agency two weeks before the hack. According to the report, the security measures nonetheless failed. The government and Mirae Asset stated that because the website is intended for information provision, there is no impact on actual fund management.
Criticism is mounting over the firm's security management, given its position as the industry's largest. SBS cited Lee Han-ul, Vice President of Aim Intelligence, who said security has often been viewed as a nuisance, with requests to patch vulnerabilities on the service side frequently met with resistance. Commentators argue that financial institutions must adhere to basic security practices to maintain the customer trust on which their business depends.
The attack exposed IDs, names and emails of 331 users, along with market information and training materials stored in the data archive. It also exposed the daily returns of fully discretionary funds from last year. Separately, personal information of 2,281 executives and employees from overseas subsidiaries and the headquarters was leaked from an internal business system. At Mirae Asset's affiliated securities firm, information on roughly 39,000 customers and employees was leaked over two days beginning on the 4th.
Mirae Asset had reported to the Financial Supervisory Service that all 12 items passed a self-security inspection requested by the agency two weeks before the hack. According to the report, the security measures nonetheless failed. The government and Mirae Asset stated that because the website is intended for information provision, there is no impact on actual fund management.
Criticism is mounting over the firm's security management, given its position as the industry's largest. SBS cited Lee Han-ul, Vice President of Aim Intelligence, who said security has often been viewed as a nuisance, with requests to patch vulnerabilities on the service side frequently met with resistance. Commentators argue that financial institutions must adhere to basic security practices to maintain the customer trust on which their business depends.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.