Hackers Hit Mirae Asset Securities Twice in Two Days, Exposing 35,000 Staff Records and 3,800 Account Numbers

Attackers broke into Mirae Asset Securities, South Korea's largest brokerage, on two consecutive days this week. They walked away with the account numbers of about 3,800 customers and the personal data of 35,255 current, former and outsourced employees, the company said on Saturday.

The first attack, on November 4, went through a mobile web login service that verifies users by phone. The second, on November 5, hit the firm's internal groupware, a system called mi-global. Mirae says the customer account numbers leaked without the account holders' names or other identifying details.

What the staff data contains

The employee side is larger. In a notice to staff signed by co-chief executives Kim Mi-sub and Hur Sun-ho, the company said most records hold a name and employee number, and some also include an email address, a mobile number and an encrypted password. Resident registration, passport and driver's license numbers were not exposed.

Mirae describes the intrusion as an outside party viewing data without authorization, with no malware and no service outage. It says no financial losses have been confirmed. The firm cut the affected servers off the network, closed outside access to the groupware and its related mobile services, and is now checking every internal system reachable from the internet. It reported the breach to the Financial Services Commission, the Financial Supervisory Service and the Personal Information Protection Commission.

The bigger near-term risk is phishing. Anyone holding a name, an employee number and a phone number can write a very convincing message to a Mirae employee, and the company has told staff not to click links or share codes even when the sender seems to know who they are.

A bad month for Korean finance

Mirae Asset Securities is the fourth Mirae Asset Group affiliate struck in less than two weeks. Mirae Asset Life Insurance disclosed a customer data leak on October 26, and intrusions were later found at Mirae Asset Global Investments and another group asset manager. Daishin Securities said on October 28 that data on 38,490 customers had leaked, and crypto exchange Gopax froze trading and withdrawals on Friday after a threatening email from people claiming to be hackers.

Financial regulators had already ordered a broad security inspection across the sector before this latest breach surfaced. The country has seen large attacks before: in late October Seoul police arrested seven people over an AI-assisted hacking ring that breached about 90 organizations. Mirae has not said who it thinks is behind this week's attacks.

Some offers on this page may be paid placements or contain affiliate links.