Key Takeaways
- • Daishin Securities disclosed that personal and credit information of 38,490 customers was leaked through a hacking attack on a system shared with an external partner, the second-largest disclosed figure in the recent wave of financial-sector breaches after Yegaram Savings Bank's 43,246 customers.
- • Mirae Asset Global Investments is investigating unauthorized account creation and data downloads from internal employee-facing systems, with the firm stating general investor information is not involved.
- • Bithumb, South Korea's No. 2 cryptocurrency exchange, reported unauthorized access to its internal employee mobile groupware, and said no leak of wallet addresses or information enabling fraudulent transfers has been confirmed.
- • The breaches came just two weeks after the FSC released emergency security check results in which 425 of 555 financial companies rated their defenses adequate in every category, raising questions about the self-reporting framework.
- • Authorities detected about 4.4 million probing attempts from North Korean IP addresses, though officials caution that IP origin alone does not establish North Korean responsibility.
Summary
Hacking attacks on South Korea's financial sector have expanded from banks to a securities firm, an asset manager, an insurer and a cryptocurrency exchange, according to the Korea JoongAng Daily. Daishin Securities, Mirae Asset Global Investments and crypto exchange Bithumb all reported breaches on Wednesday, two weeks after regulators released the results of an emergency security check in which most financial firms rated their own defenses adequate.
Daishin said the personal and credit information of 38,490 customers was leaked. The attack hit a system the firm shares with an external partner, linked to its online account-opening service for discretionary investment accounts. Daishin detected abnormal access on Oct. 17, blocked the attacking IP addresses and reported the incident to authorities. Working with the Financial Security Institute, it analyzed more than 60,000 signals over 10 days and confirmed the leak on Monday. The leaked data includes names, email addresses, postal addresses, communication IDs, bank names, encrypted deposit and withdrawal account numbers, integrated account numbers and mobile phone numbers. The firm said it will notify affected customers individually and compensate losses in line with the law.
Mirae Asset Global Investments is investigating an intrusion in which it believes an intruder created an account and downloaded data from systems serving employees without authorization. An official said the system does not serve individual clients, so general investor information is not involved, though a leak could include employee names, email addresses and files. Mirae Asset Life Insurance, an affiliate, reported a breach of its customer application system and part of its website to authorities on Sunday.
Bithumb found traces of unauthorized access to its internal mobile groupware for employees on Tuesday and reported it Wednesday. The exchange said the breached system supports employee work rather than core cryptocurrency trading infrastructure, and that no leak of information usable for fraudulent payments or asset transfers, such as wallet addresses, has been confirmed. Other companies using the same outsourced groupware could be exposed if a common software vulnerability is responsible.
Regulators responded with an emergency inspection meeting by the Financial Services Commission on Wednesday, and on-site inspections by the Financial Supervisory Service. FSS Governor Lee Chan-jin said cyberattacks were growing more sophisticated, with AI being used as a hacking tool, and urged financial companies to build autonomous defense systems. Authorities plan to require cryptocurrency and other businesses outside the Electronic Financial Transactions Act to adopt security measures and incident response systems comparable to those of banks. The National Police Agency's National Office of Investigation opened a preliminary inquiry into the securities and crypto breaches.
The timing has put the self-inspection framework under scrutiny. In the emergency check, 555 financial companies assessed themselves across 12 categories through Oct. 8; the FSC released results on Oct. 14, when 130 reported shortfalls in some items and 425 rated their security adequate in every category. Critics say checklist-based self-assessment is insufficient to uncover weaknesses. The recent breaches exposed the weaknesses the FSC had flagged, including missing authentication for external systems. Dongguk University information security professor Hwang Suk-jin urged a shift from after-the-fact sanctions to prevention and on-site government verification.
On North Korea, authorities warned financial firms on Oct. 21 about about 4.4 million probing attempts traced to North Korean IP addresses. Officials said this alone does not show North Korean involvement, noting that about 40 North Korean government websites went down earlier in October. A regulatory official said an outside party most likely hacked North Korean systems and used their IPs to target domestic firms. Experts warn the threat could spread to other sectors handling large volumes of personal data, such as delivery platforms.
Daishin said the personal and credit information of 38,490 customers was leaked. The attack hit a system the firm shares with an external partner, linked to its online account-opening service for discretionary investment accounts. Daishin detected abnormal access on Oct. 17, blocked the attacking IP addresses and reported the incident to authorities. Working with the Financial Security Institute, it analyzed more than 60,000 signals over 10 days and confirmed the leak on Monday. The leaked data includes names, email addresses, postal addresses, communication IDs, bank names, encrypted deposit and withdrawal account numbers, integrated account numbers and mobile phone numbers. The firm said it will notify affected customers individually and compensate losses in line with the law.
Mirae Asset Global Investments is investigating an intrusion in which it believes an intruder created an account and downloaded data from systems serving employees without authorization. An official said the system does not serve individual clients, so general investor information is not involved, though a leak could include employee names, email addresses and files. Mirae Asset Life Insurance, an affiliate, reported a breach of its customer application system and part of its website to authorities on Sunday.
Bithumb found traces of unauthorized access to its internal mobile groupware for employees on Tuesday and reported it Wednesday. The exchange said the breached system supports employee work rather than core cryptocurrency trading infrastructure, and that no leak of information usable for fraudulent payments or asset transfers, such as wallet addresses, has been confirmed. Other companies using the same outsourced groupware could be exposed if a common software vulnerability is responsible.
Regulators responded with an emergency inspection meeting by the Financial Services Commission on Wednesday, and on-site inspections by the Financial Supervisory Service. FSS Governor Lee Chan-jin said cyberattacks were growing more sophisticated, with AI being used as a hacking tool, and urged financial companies to build autonomous defense systems. Authorities plan to require cryptocurrency and other businesses outside the Electronic Financial Transactions Act to adopt security measures and incident response systems comparable to those of banks. The National Police Agency's National Office of Investigation opened a preliminary inquiry into the securities and crypto breaches.
The timing has put the self-inspection framework under scrutiny. In the emergency check, 555 financial companies assessed themselves across 12 categories through Oct. 8; the FSC released results on Oct. 14, when 130 reported shortfalls in some items and 425 rated their security adequate in every category. Critics say checklist-based self-assessment is insufficient to uncover weaknesses. The recent breaches exposed the weaknesses the FSC had flagged, including missing authentication for external systems. Dongguk University information security professor Hwang Suk-jin urged a shift from after-the-fact sanctions to prevention and on-site government verification.
On North Korea, authorities warned financial firms on Oct. 21 about about 4.4 million probing attempts traced to North Korean IP addresses. Officials said this alone does not show North Korean involvement, noting that about 40 North Korean government websites went down earlier in October. A regulatory official said an outside party most likely hacked North Korean systems and used their IPs to target domestic firms. Experts warn the threat could spread to other sectors handling large volumes of personal data, such as delivery platforms.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.