Mirae Asset Securities confirms breaches exposing about 3,800 customer accounts and 35,255 employee records

Mirae Asset Securities confirmed two separate cyber attacks exposing customer account numbers and employee personal information through its mobile-web login service and mi-global groupware platform, the company said in notices published Nov. 7, 2026. The first intrusion hit the mobile-web phone-authentication login service on Nov. 4, 2026, and the second struck the mi-global internal groupware platform on Nov. 5, 2026.

About 3,800 customers had account numbers exposed through the mobile-web phone-authentication login service after abnormal external access. Customer names and other information were not exposed, according to the company. The mi-global internal groupware platform was hit by a separate external attack, exposing personal information for 35,255 current, former and outsourced employees and contractors.

Employee records included names and employee numbers, while some also contained e-mail addresses, mobile phone numbers and passwords stored in encrypted form. The precise combination varied by individual, and the company did not disclose how it protected the passwords. Mirae Asset Securities disconnected the affected service and server, blocked external connections and suspended access after detecting the exposures.

The company reported the incident to South Korea’s Financial Services Commission, Financial Supervisory Service and Personal Information Protection Commission. It disclosed that some 39,000 customers and employees had personal information leaked, describing the figure as a combined total. The breach followed similar data leaks at sister companies including Mirae Asset Life Insurance.

Separately, Mirae Asset Global Investments confirmed unauthorized external access to some web systems on Oct. 28, 2026, and said no investor information or personal credit records were exposed. The firm, a distinct entity from Mirae Asset Securities, blocked access routes, launched an emergency response and identified no general customer information or financial damage.

The Financial Services Commission said more than 470,000 personal data records leaked from 37 financial-sector companies over the past month, with stolen funds estimated at 1 billion won or US$745,000. The regulator counted 40 data leak incidents at 37 companies since Sept. 30, including five savings banks, five financial investment firms, four commercial banks and three insurance firms. The commission cited about 100,000 data leak cases tied to October attacks on 16 financial firms, including banks.

On Oct. 27, 2026, Bithumb confirmed unauthorized access involving its internal mobile groupware system in related October incidents. The compromised groupware used third-party platform Daou Office and was physically separated from customer-facing systems and the exchange’s trading network. Bithumb stated that customer crypto holdings were not accessible because its employee system is separate from its trading platform, and that it detected no abnormal withdrawals, leaving customer virtual assets unaffected. The exchange reported the intrusion to the Korea Internet & Security Agency and the Personal Information Protection Commission.

No one has reported theft of funds in the Bithumb incident. Investigators have not tied the intrusion to other incidents disclosed on the same day, and they have not publicly identified the attacker. Authorities have not reported evidence that the South Korean attacks share a common source. Bithumb has not disclosed the number of people affected, which employee records were exposed, or whether disruptions affected deposits, withdrawals and other trading services, and it has not given a completion date for its review.

Daishin Securities found unauthorized access on Oct. 17 to a server tied to online account openings. Hackers obtained personal and credit data for 38,490 customers, including names, mobile phone numbers, bank account numbers, physical addresses and email addresses. The brokerage said it will compensate for any resulting damage, took emergency measures and notified affected customers.

South Korea’s Financial Supervisory Service is investigating the breaches at Bithumb, Daishin Securities and Mirae Asset Global Investments. The FSS sent inspection teams to Bithumb and Daishin Securities on Oct. 28, 2026, and may expand examinations if the FSS finds legal violations. Governor Lee Chan-jin urged financial firms to tighten computer security during Oct. 28 meetings with banking executives and bank holding company board chairs, warning that attackers might use artificial intelligence to locate weaknesses. Officials warned website operators on Oct. 28, 2026 that PHP vulnerabilities can let attackers run commands without logging in.

A back-office breach differs from a hot wallet hack because attackers do not drain crypto directly, though it can open the door to targeted attacks on users and employees. A Solana network hot wallet hack hit Upbit in November 2025, draining roughly $36 million, and local authorities suspect North Korea’s Lazarus Group carried it out.