Three South Korean financial firms, Daishin Securities, Mirae Asset Global Investments and crypto exchange Bithumb, have reported data breaches or attempted intrusions, according to Yonhap on October 28, 2026. The Bithumb data breach drew the most attention, since it involves a major exchange, but the confirmed numbers so far sit with Daishin: personal and credit information on 38,490 customers.
The story spread quickly across Reuters, CoinDesk, LCX Exchange, Coinfomania, Crypto Briefing and The Crypto Times. Each outlet carried the same core facts. Bithumb found unauthorized access to an internal mobile groupware system on October 27, Daishin detected an intrusion on October 17, and Mirae Asset said it blocked abnormal outside access and that investor information was not affected.
Much remains unknown, and that gap matters more than the headline. Bithumb has not said how many people are affected or whether customer data left its systems. If you followed our earlier reporting on the Navigate360 breach that sat undetected for seven months, you know why scope statements in the first 48 hours deserve caution. This analysis separates what the reports confirm from what they leave open.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Three Firms, Three Different Incidents
Grouping the three companies under one headline makes the story sound like a coordinated campaign. The reports do not say that. Yonhap lists three separate disclosures with different systems, different dates and different outcomes. Treating them as one event would overstate what anyone knows.
Daishin Securities reported the largest confirmed exposure. A server tied to online securities-account openings for discretionary investment services was accessed without authorization, and 38,490 customers had personal and credit information leaked. Bithumb reported a hit on an internal mobile-office system. Mirae Asset Global Investments described a blocked attempt against some of its web systems.
The Financial Supervisory Service was assessing the incidents involving all three firms, per the reports. That shared regulator is the common thread. The technical details differ enough that analysts should treat each firm as its own case until investigators publish findings.
| Firm | What was hit | Confirmed impact | Still unconfirmed |
|---|---|---|---|
| Daishin Securities | Server linked to online account openings for discretionary investment services | 38,490 customers, with names, emails and mobile numbers exposed | Full attacker method and the date of customer notices |
| Bithumb | Internal mobile groupware (mobile-office) system | Personal-information leakage from that system, reported to KISA and the PIPC | Number of affected people, whether member data was involved |
| Mirae Asset Global Investments | Some web systems | Abnormal external access blocked, investor information said to be unaffected | Scope and cause of the attempt |
Daishin Securities: 38,490 Customers and an October 17 Detection
Daishin’s disclosure is the only one with a hard victim count. According to Yonhap, personal and credit information belonging to 38,490 customers leaked. The exposed fields were names, email addresses and mobile phone numbers. Some account numbers were reportedly leaked too, though in encrypted form.
The detection date is October 17. That means the firm noticed the intrusion 11 days before the wider three-company story broke on October 28. The reports do not explain whether Daishin notified customers on a different timeline or whether the 11-day span reflects investigation time. Readers should not read a delay into it without more detail.
The affected server supports online account openings for discretionary investment services. These are accounts where the firm manages money on a client’s behalf. Onboarding systems collect identity details by design, which makes them a recurring target at brokerages. The reports do not say whether identity documents or resident registration numbers were touched, so this analysis does not assume it.
Bithumb’s Mobile Groupware Breach
Bithumb discovered the intrusion on October 27, one day before the reports. Unauthorized access to its internal mobile groupware, the kind of system employees use for email, scheduling, approvals and messaging, resulted in personal-information leakage. The company reported the matter to the Korea Internet & Security Agency and the Personal Information Protection Commission.
Bithumb was still investigating the scope when the reports were filed, including whether member information was involved. That wording is the most important detail in the whole story. It tells us the exchange had confirmed a leak of personal information but had not yet established whose information it was.
What the trading-system separation means
Reports say the breached work system was separate from Bithumb’s virtual-asset trading system, and that customer virtual assets could not be accessed through this breach. For account holders, that is the reassuring part. A compromise of a staff tool does not hand an attacker the keys to a trading engine or a custody wallet.
Still, separation limits damage without erasing it. Internal systems often hold employee data, partner contacts and sometimes customer service records. An attacker with a foothold in a groupware tool can also study how a company communicates, which helps with later phishing aimed at staff or customers.
What Bithumb has not said
The reports leave four questions open. They do not say how many people are affected, whether deposits or withdrawals were disrupted, whether customer data was exposed, or how the attacker got in. Anyone quoting a number for the Bithumb incident today is guessing. We will update this piece when Bithumb or the regulators publish figures.
Mirae Asset Global Investments Blocks Abnormal Access
Mirae Asset Global Investments sits at the quiet end of this story. The firm said it blocked abnormal external access to some of its web systems and that investor information was not affected. No customer count, no stolen-data list and no named attacker appear in the reports.
A blocked attempt is still worth reporting. Security teams read it as evidence that monitoring worked, but it also shows that financial firms in Korea were being probed in the same window. The cause and scope of the Mirae Asset incident remain unconfirmed, so the responsible framing is a disclosed attempt, not a confirmed breach.
Credit goes to firms that disclose near-misses. Many organizations stay silent when defenses hold. By speaking up, Mirae Asset gives regulators and peers a data point they would otherwise lack, even if the details remain thin.
What Is Still Unconfirmed
The gap between confirmed and unconfirmed facts is wide enough to justify its own section. Below is the status as of October 28, based only on what the reports state.
| Date | Event | Firm | Status |
|---|---|---|---|
| October 17 | Unauthorized access detected on account-opening server | Daishin Securities | Confirmed by reports |
| October 27 | Unauthorized access to mobile groupware discovered | Bithumb | Confirmed by reports |
| Around October 27-28 | Abnormal external access to web systems blocked | Mirae Asset Global Investments | Firm statement, scope unconfirmed |
| October 28 | Yonhap reports the three disclosures together | All three | Confirmed |
| Not yet announced | Number of affected Bithumb members, if any | Bithumb | Unconfirmed |
| Not yet announced | Regulator findings from the FSS assessment | All three | Pending |
Note the middle row. The reports do not pin a precise date on the Mirae Asset event, so the table shows it as a range tied to the news cycle, not as a confirmed date.
Why Groupware and Mobile-Office Systems Attract Attackers
Companies lock down trading engines and custody wallets harder than they lock down office tools. Groupware sits in the middle. It touches email, calendars, shared files and employee directories, and it is often reachable from phones and home networks. That convenience is the exact reason it draws attention.
Mobile access adds another layer. Phones run on networks the company does not control, apps update on their own schedules, and stolen or phished credentials work from anywhere. A single compromised employee login can open a view into internal contacts and documents.
We have seen the same pattern in other incidents. In our coverage of the TiDB Cloud breach, attackers used a stolen service account for 28 days. The lesson carries over: a single weak identity, not a flashy exploit, often decides the outcome. Whether that happened at Bithumb is unknown, and the reports offer no hint of the entry method.
Encrypted Account Numbers Help, but Names and Phone Numbers Still Hurt
Daishin’s leak included names, email addresses and mobile numbers. Some account numbers reportedly leaked in encrypted form. Encryption blunts the damage from the account numbers, but the plain-text fields are exactly what scammers need.
A name paired with a phone number and an email lets a fraudster impersonate the brokerage convincingly. A text message that mentions the right firm and the right customer name earns trust fast. Victims of leaks like this typically face a wave of targeted phishing in the weeks that follow, and the reports do not suggest this case will differ.
The scale of 38,490 people is modest next to mega-breaches. Our earlier analysis of Capcom’s 11.77M-record breach and its 196 password resets shows how a headline count and the real customer action required can diverge. Even so, a financial customer has more to lose per record than a game account holder.
The Regulatory Response: FSS, KISA and the PIPC
Three bodies appear in the reports. The Financial Supervisory Service was assessing the incidents at all three firms. Bithumb said it reported its breach to the Korea Internet & Security Agency and the Personal Information Protection Commission. Each plays a different role.
The FSS supervises financial institutions and looks at whether a firm met its security duties. KISA handles technical incident response and analysis. The PIPC enforces personal-information rules and can pursue penalties when a company failed to protect data. The reports do not say any penalty is planned, and nothing here should be read as a prediction of a fine.
What matters for readers is sequencing. Regulators usually finish technical reviews before announcing findings, which means the next few weeks may bring updates on Bithumb’s scope and on whether the three incidents link up. Until then, the official line is that the investigations are ongoing.
Market Impact: Trust Is the Real Asset at Stake
The reports do not cite any price move tied to the disclosures, and we will not invent one. The more useful question is how customers weigh trust. Exchanges and brokerages compete on reliability, and a breach, even one that avoids customer funds, gives rivals a talking point.
Bithumb’s statement that its trading system was separate helps it. If the investigation confirms no member data left the building, the story fades into a minor operational note. If member records turn out to be involved, the exchange faces a harder conversation with users and regulators.
Crypto platforms also face a wider backdrop. Our look at PHP2Shell and the 793 of 1,488 crypto domains showing PHP described how exposed exchange web stacks can be. The Korean incidents are not linked to that research in any report, but both underline how much of the sector’s risk lives in ordinary infrastructure.
How This Compares With Other Recent Incidents
Context helps readers size the story. The table below sets the Korean disclosures beside incidents we have already covered, using the figures from those articles.
| Incident | Headline figure | Detection or dwell detail | Customer assets at risk |
|---|---|---|---|
| Daishin Securities (Oct. 2026) | 38,490 customers | Detected October 17 | Personal and credit data, encrypted account numbers in part |
| Bithumb (Oct. 2026) | Unconfirmed | Discovered October 27 | Trading system reported separate, assets not reachable |
| Mirae Asset (Oct. 2026) | None reported | Access blocked | Investor information said unaffected |
| Navigate360 / P3 Global Intel | 8 million crime tips | 7 months | Sensitive tip data |
| TiDB Cloud | Stolen service account | 28 days | Cloud customer environment |
| Capcom | 11.77M records | 196 password resets | Account data |
The Korean cases look small and fast by comparison. A detection within days, as Bithumb reported, beats a seven-month dwell. That says something encouraging about monitoring at these firms, though it does not settle what the attackers took.
Historical Context: Why Exchanges Keep Landing in the Crosshairs
Crypto exchanges have drawn attackers for more than a decade because they hold valuable assets and large user databases. Brokerages draw the same interest for identity data. When both sectors report incidents in the same week, analysts naturally ask whether a shared tool, vendor or attacker links them.
No report ties the three Korean incidents together. They hit different systems on different dates, and Mirae Asset’s was blocked. Still, financial institutions often share software suppliers, so a common weakness is plausible and worth watching. Investigators will test that idea before anyone can confirm or reject it.
Triage discipline helps while facts are thin. Security teams reading these reports can borrow the approach from our guide on EPSS, CVSS, CISA KEV and SSVC, which ranks threats by exploitation likelihood instead of raw headline size.
What Customers Should Do Now
If you hold an account at Daishin Securities, expect notice about your data and treat unexpected messages with suspicion. If you use Bithumb, remember that the company has not confirmed any member data exposure. Staying calm and careful beats panic.
- Do not click links in texts or emails that claim to come from your broker or exchange. Open the official app or type the address yourself.
- Turn on two-factor authentication on every financial and crypto account.
- Use unique passwords, and change any you reused across services.
- Check whether your email shows up in known leaks. Our walkthrough on setting up Have I Been Pwned monitoring takes about 40 minutes.
- Watch for calls or messages that quote your name and phone number back to you. That detail is exactly what leaked data enables.
- Wait for official statements before acting on social media rumors about balances or withdrawals.
What Security Teams Should Take Away
Defenders can read three lessons without waiting for the investigations. First, internal collaboration tools deserve the same monitoring as customer-facing systems. Bithumb’s case shows that a staff system can leak personal information even when the trading core stays safe.
Second, segmentation works. Bithumb’s separation of its work system from trading is the reason the story is about personal data and not stolen coins. Teams that mix these environments should treat this as a prompt to review their network boundaries.
Third, log coverage on mobile and web entry points pays off. Mirae Asset blocked abnormal access, which implies it saw it. Teams building detections for web-facing intrusions can adapt the approach in our tutorial on Wazuh SIEM rules for PHP2Shell. For ongoing coverage, see the cybersecurity section.
Predictions: What Happens Next
These are analyst judgments based on how similar cases usually unfold, not reported facts.
- Bithumb will publish a scope update within weeks. Because it already notified KISA and the PIPC, pressure to state whether member data was involved will build quickly.
- Phishing campaigns will cite the breaches. Scammers favor named incidents, so expect fake notices that mimic Daishin or Bithumb messaging.
- Regulators will ask for a common-cause review. With three firms disclosing in one window, the FSS has reason to check for shared suppliers or tools.
- Groupware security will become an audit priority. Firms will likely tighten mobile-office controls and multi-factor rules for internal tools.
- The Mirae Asset case will stay small. A blocked attempt with unaffected investor data rarely grows, unless new evidence appears.
FAQ: Bithumb, Daishin and Mirae Asset Breaches
Which companies reported the breaches?
Yonhap reported that Daishin Securities, Mirae Asset Global Investments and Bithumb disclosed data breaches or attempted intrusions. The story was carried by Reuters, CoinDesk and several crypto outlets on October 28, 2026.
How many people were affected by the Bithumb data breach?
That number is unconfirmed. Bithumb was still investigating the scope, including whether member information was involved, when the reports were filed.
Were customer crypto assets at risk at Bithumb?
Reports say the breached internal work system was separate from the virtual-asset trading system and that customer virtual assets could not be accessed through this breach. Whether deposits or withdrawals were affected has not been confirmed.
What data did Daishin Securities lose?
Personal and credit information on 38,490 customers leaked, including names, email addresses and mobile phone numbers. Some account numbers reportedly leaked in encrypted form. Daishin detected the unauthorized access on October 17.
Was Mirae Asset breached?
Mirae Asset Global Investments said it blocked abnormal external access to some web systems and that investor information was not affected. The scope and cause remain unconfirmed.
Who is investigating?
The Financial Supervisory Service was assessing the incidents at all three firms. Bithumb also reported its breach to the Korea Internet & Security Agency and the Personal Information Protection Commission.
Are the three incidents connected?
No report links them. They involve different systems and dates, so treat them as separate until investigators say otherwise.
What should affected customers do?
Ignore unsolicited links, turn on two-factor authentication, use unique passwords, and follow the official notices from each firm. Be alert to scam messages that use your real name and phone number.
