Key Takeaways
- • Hackers breached the website of the Pension Fund Investment Pool, a South Korean Ministry of Economy and Finance system managing 77 trillion won (approximately $57.2 billion) in idle government and public institution funds, in which Mirae Asset Global Investments is a lead manager.
- • Attackers logged into 307 member accounts and downloaded about 960MB of work data, including 2025 daily return records for fully discretionary government funds.
- • A separate intrusion into Mirae Asset's internal integrated work system (MGIS) exposed personal information of 2,281 people, bringing the total estimated personal data theft to 2,612 employees in South Korea and abroad.
- • The company detected the breach four days after the attack began, on November 26, and reports no confirmed financial damage or leakage of unique identification or credit information.
- • The Financial Supervisory Service has expanded on-site inspections to Mirae Asset Securities and signaled that management, including CEOs, will be held strictly accountable.
Summary
A hacking attack has directly struck the website of the Pension Fund Investment Pool, a system under South Korea's Ministry of Economy and Finance that entrusts idle funds from government and public institutions to professional asset managers for consolidated management. According to Mirae Asset Global Investments' electronic financial breach report submitted to the Financial Supervisory Service and obtained by the office of Shin Dong-wook of the People Power Party, the intrusion began around 7:11 p.m. on November 22. As of the end of June this year, the pool's total assets under custody stood at 77 trillion won (approximately $57.2 billion), of which the money market fund managed by Mirae Asset Global Investments accounted for 12.9 trillion won (approximately $9.6 billion). Mirae Asset Global Investments won a bid in 2021 and, after re-bidding, has held a lead manager position alongside Samsung Asset Management.
The attackers bypassed security controls by collecting internal URL and parameter information from an externally exposed web server status page, then sequentially querying member numbers. From about 12:43 a.m. on November 24, they logged into 307 member accounts over roughly 11 minutes using stolen password hash values, exposing IDs, names, emails and encrypted passwords of 331 employees of client corporations. Between 11:36 p.m. on November 23 and 2:23 a.m. the next day, they downloaded about 960MB of files by enumerating attachment numbers, including market information, training materials and 2025 daily return records for fully discretionary funds. The outflow of government fund return trends is expected to cause significant fallout, according to the reporting.
A parallel intrusion targeted the company's MGIS internal system, which handles Financial Supervisory Service compliance, human resources and finance operations. On November 23, the attackers bypassed email authentication, created 17 external accounts, escalated to administrator privileges and altered one administrator's password. They downloaded about 280MB of data, including disclosure materials for overseas affiliates, and obtained personal information of 2,281 people, comprising 1,715 employees at 31 overseas affiliates and 566 headquarters staff. The company became aware of the breach only on November 26, four days after the initial attack, and subsequently blocked overseas access, restricted vulnerable functions and reset account passwords. Mirae Asset states that no unique identification information, personal credit data or individual customer data leakage, and no financial damage, has been confirmed.
The incidents follow a series of breaches across Mirae Asset affiliates. Mirae Asset Life Insurance previously suffered an attack exposing customer names, resident registration numbers, account numbers and retirement pension transaction records. Unauthorized intrusions were also confirmed at Mirae Asset Global Investments' business web system and the Energy Infrastructure Asset Management website, and Mirae Asset Securities previously leaked account numbers of about 3,800 customers and personal data of 35,255 employees. The Financial Supervisory Service is conducting on-site inspections of Mirae Asset Life Insurance and Mirae Asset Global Investments and has added Mirae Asset Securities, examining whether intrusion routes overlap; it has not confirmed the same perpetrator. FSS Governor Lee Chan-jin has instructed that management, including CEOs of large financial companies, be held strictly accountable, in line with banking-sector sanctions policy. The Financial Services Commission plans a full security inspection of about 580 companies, including financial firms and virtual asset service providers. On the 5th, Mirae Asset Group announced an organizational restructuring that elevates its information security function, though the pace of remediation remains the central question. Observers note the return data could affect trust in institutions entrusted with the pool and in the entrusting bodies themselves.
The attackers bypassed security controls by collecting internal URL and parameter information from an externally exposed web server status page, then sequentially querying member numbers. From about 12:43 a.m. on November 24, they logged into 307 member accounts over roughly 11 minutes using stolen password hash values, exposing IDs, names, emails and encrypted passwords of 331 employees of client corporations. Between 11:36 p.m. on November 23 and 2:23 a.m. the next day, they downloaded about 960MB of files by enumerating attachment numbers, including market information, training materials and 2025 daily return records for fully discretionary funds. The outflow of government fund return trends is expected to cause significant fallout, according to the reporting.
A parallel intrusion targeted the company's MGIS internal system, which handles Financial Supervisory Service compliance, human resources and finance operations. On November 23, the attackers bypassed email authentication, created 17 external accounts, escalated to administrator privileges and altered one administrator's password. They downloaded about 280MB of data, including disclosure materials for overseas affiliates, and obtained personal information of 2,281 people, comprising 1,715 employees at 31 overseas affiliates and 566 headquarters staff. The company became aware of the breach only on November 26, four days after the initial attack, and subsequently blocked overseas access, restricted vulnerable functions and reset account passwords. Mirae Asset states that no unique identification information, personal credit data or individual customer data leakage, and no financial damage, has been confirmed.
The incidents follow a series of breaches across Mirae Asset affiliates. Mirae Asset Life Insurance previously suffered an attack exposing customer names, resident registration numbers, account numbers and retirement pension transaction records. Unauthorized intrusions were also confirmed at Mirae Asset Global Investments' business web system and the Energy Infrastructure Asset Management website, and Mirae Asset Securities previously leaked account numbers of about 3,800 customers and personal data of 35,255 employees. The Financial Supervisory Service is conducting on-site inspections of Mirae Asset Life Insurance and Mirae Asset Global Investments and has added Mirae Asset Securities, examining whether intrusion routes overlap; it has not confirmed the same perpetrator. FSS Governor Lee Chan-jin has instructed that management, including CEOs of large financial companies, be held strictly accountable, in line with banking-sector sanctions policy. The Financial Services Commission plans a full security inspection of about 580 companies, including financial firms and virtual asset service providers. On the 5th, Mirae Asset Group announced an organizational restructuring that elevates its information security function, though the pace of remediation remains the central question. Observers note the return data could affect trust in institutions entrusted with the pool and in the entrusting bodies themselves.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.