Skip to content
Sign in
Defense & Security · Asia Pacific

Daishin reports customer data leak as cyber incidents hit South Korean finance firms

Daishin Securities reported that suspected hacker access exposed information belonging to 38,490 customers, while Mirae Asset Global Investments and Bithumb reported separate cyber incidents. Mirae Asset said investor information was unaffected, and Bithumb is investigating whether customer data was exposed.

AI-assisted synthesis · Based on 5 outlets' reporting · Article text read from 3 of 5 outletsHow it's made

View timeline · 7 entries
5 outlets2 regionsLatest reporting 4 min read
Coverage: Center OnlyL 0 · C 4 · R 0 · 1 unrated
Updat3 graphic: South Korea
Updat3 graphic · Map data: Natural Earth Natural Earth (public domain)

What happened

Key facts

  • Daishin Securities reported a data leak affecting 38,490 customers after suspected hacker access (per freepressjournal.in, koreatimes.co.kr, TechCrunch).
  • Daishin Securities, Mirae Asset Global Investments and Bithumb reported cyber incidents in South Korea on Wednesday (per TechCrunch, koreatimes.co.kr, newsbytesapp.com).
  • Daishin Securities confirmed the leak after reviewing more than 60,000 signals that appeared to be legitimate service requests (per koreatimes.co.kr).
  • The reported exposed information at Daishin Securities included customers’ names, email addresses and mobile phone numbers (per TechCrunch, freepressjournal.in, koreatimes.co.kr).
  • Bithumb was investigating whether customer data had been exposed (per koreatimes.co.kr, TechCrunch).
  • South Korea’s warning level was raised to “caution,” the second-lowest tier in a four-tier system, and companies and government agencies were asked to apply security updates (per freepressjournal.in, koreatimes.co.kr, TechCrunch).
  • The publicly identified total of financial firms reporting incidents had reached 20 (per koreatimes.co.kr).

The brief

Daishin Securities reported that suspected hacker access exposed information belonging to 38,490 customers, as two other South Korean financial firms disclosed separate cyber incidents.

The reports place the incidents across the brokerage and cryptocurrency sectors, but the confirmed consequences differ: Daishin reported a customer-data leak, Mirae Asset Global Investments said investor information was unaffected, and Bithumb said it was investigating whether customer data had been exposed. Daishin detected suspicious access on Oct.

17 to a server used for online securities account openings for discretionary investment services, according to The Korea Times. The brokerage confirmed the leak after reviewing more than 60,000 signals that appeared to be legitimate service requests. TechCrunch reported that the exposed information included customers’ names, email addresses and mobile phone numbers.

The incidents were reported on Wednesday. The Korea Times said the publicly identified total of financial firms reporting cyber incidents had reached 20. The three named cases show distinct outcomes: Daishin disclosed compromised customer information, Bithumb was still checking for possible exposure, and Mirae Asset said investor information was not affected.

South Korean authorities announced broader cybersecurity checks as breaches affected public institutions and financial firms. Free Press Journal reported plans to inspect around 170 key IT infrastructures in the private sector, alongside vulnerability assessments of 111 public organisations responsible for managing such infrastructure.

The ministry’s stated focus included internet-connected services such as websites and public-facing servers. The government also raised its warning level to “caution,” the second-lowest of four tiers, and asked companies and government agencies to apply security updates, Free Press Journal reported.

The outlet linked the checks to repeated cybersecurity breaches and said 16 commercial banks had reported cyberattacks leading to customer-data breaches during the year. The Korea Times reported that South Korea’s Financial Supervisory Service had warned in an Oct.

6 notice that some IP addresses could not be tied to a specific country, and that apparent locations could reflect indirect routing. That warning underscores a technical attribution challenge, but the reporting does not identify who accessed Daishin’s server or establish a common perpetrator behind the incidents.

TechCrunch placed the financial incidents within a wider concern about AI-assisted hacking, citing security researchers who linked a September wave of attacks in South Korea to a suspected China-based hacker using an AI penetration-testing tool called Artex.

That account concerns a separate wave and does not establish that the same actor or tool was involved in the incidents at Daishin, Mirae Asset or Bithumb. TechCrunch also reported a cybersecurity incident at Japan’s GMO Internet the day before the South Korean disclosures, without linking it to them.

Why it matters

  • Daishin customers face the concrete risk of exposed personal information: the reported leak affected 38,490 customers and included names, email addresses and mobile phone numbers.
  • Bithumb customers face uncertainty while the exchange investigates possible data exposure; Mirae Asset investors were told their information was not affected.
  • South Korean authorities’ planned checks cover around 170 private-sector IT infrastructures and 111 public organisations, while the government has raised its warning level to “caution.”
  • The Korea Times reported that 20 financial firms had been publicly identified as reporting incidents, and Free Press Journal said 16 commercial banks had reported attacks leading to customer-data breaches during the year.

What to watch next

  • Whether Bithumb’s investigation finds that customer data was exposed.
  • Whether Daishin or authorities identify who accessed the account-opening server.
  • Whether South Korea’s planned vulnerability assessments cover the approximately 170 private-sector IT infrastructures and 111 public organisations described by Free Press Journal.
  • Whether authorities’ security checks or warnings produce further guidance for financial firms and public organisations.

How it's being covered

Coverage analysisShow details
6 source articles · 5 unique outlets
Outlet political mix: Center Only· 4 Center · 1 unrated
Where the outlets are based: US/Canada 40% · Asia 40% · Other 20%
Outlet political mix
Center Only
Left
Center
Right
0 outlets
4 outlets
0 outlets
The marker shows coverage balance: each unique outlet counts once. 1 unrated outlet is not included.
Geography
Where the outlets covering this story are based.
5 unique outletsDominant coverage: US/Canada
Coverage imbalance
  • Coverage is currently concentrated among Center-rated outlets (4 of 4 rated sources); comparatively few Left or Right-rated outlets have published on the event.
How we measure coverage

One source is from a wire service (AP, Reuters, AFP or Bloomberg), whose reporting other outlets often republish.

How outlets' accounts compare

2 framing differences · 1 uncorroborated claim · 3 information gaps
The reports repeat the same account with different emphasis; its central claims are not independently confirmed in the reporting Updat3 read.Compared across 3 reports whose article text Updat3 read; 2 other outlets were checked by headline only.
Framing / emphasis differences
Sources emphasise different angles, actors or consequences of the same reporting.
  • Free Press Journal emphasizes the government’s planned inspections, public-sector assessments and warning-level change; The Korea Times and TechCrunch foreground the incidents at Daishin, Mirae Asset and Bithumb.
  • TechCrunch connects the story to researchers’ account of a separate September attack wave involving a suspected China-based hacker and Artex; it does not say that this actor or tool was involved in the current financial incidents.
Updat3: These are differences of emphasis, not disputes about what is reported. They do not show that the reported claims are true.
One-sided or uncorroborated claims
Claims that come from one party or one source family and are not independently corroborated.
  • The Korea Times reported that the Financial Supervisory Service warned that some IP addresses could not be linked to a specific country and that apparent locations could reflect indirect routing.
Updat3: Not independently corroborated yet — treat as a claim, not an established fact.
Not established by the reporting
Information the available reporting does not contain or confirm. This is a gap, not a disagreement.
  • The sources do not provide customer counts or confirmed data-exposure findings for Bithumb or Mirae Asset beyond the companies’ reported positions.
  • Bithumb was investigating possible customer-data exposure; the sources do not report a finding that data was taken.
  • The sources do not identify who accessed Daishin’s server or establish that the three firms’ incidents shared a perpetrator.
Updat3: Updat3 cannot conclude anything about this from the current sources.

Timeline

Developments from this story's sources, dated background we compiled and fact-checked, and our earlier coverage. Each row says which.
  1. The Credit Information Act, originally enacted in 1995, governs the handling of information used in credit and financial services.
    Background · from our historical context
  2. The Act on the Protection of Information and Communications Infrastructure, enacted in 2001, provided a framework for protecting designated critical information infrastructure.
    Background · from our historical context
  3. South Korea enacted the Personal Information Protection Act.
    Background · compiled and fact-checked by Updat3
  4. On March 20, 2013, malicious software disrupted computer networks at several South Korean banks and broadcasters; the government attributed the attack to North Korea, which denied involvement.
    Background · from our historical context
  5. In January 2014, South Korean authorities disclosed that an employee of a credit-rating company had stolen personal and financial data belonging to about 20 million customers of three credit-card companies.
    Background · from our historical context
  6. In 2015, the Financial Security Institute was formed to support cybersecurity across the financial sector, including through information sharing and security services.
    Background · from our historical context
  7. Amendments to the Personal Information Protection Act, the Network Act and the Credit Information Act—often called South Korea’s “data three laws”—took effect on August 5, 2020.
    Background · from our historical context

How we got here

South Korea’s financial sector had faced major cyber incidents before the 2026 reports. On March 20, 2013, malicious software disrupted computer networks at several South Korean banks and broadcasters; the government attributed the attack to North Korea, which denied involvement.

In January 2014, South Korean authorities disclosed that an employee of a credit-rating company had stolen personal and financial data belonging to about 20 million customers of three credit-card companies. South Korea’s legal framework for personal information protection developed alongside those threats.

Original sources

2 of 6 articles · US/Canada · Show all

Every story links to the reporting it was built from. How we choose sources

Spotted a factual error, a broken link or a misleading summary? Tell us.