South Korean brokerage Daishin Securities has confirmed that hackers took personal and credit information belonging to 38,490 customers. The attackers got in through a server linked to its remote account-opening service. In a news release on 28 October, reported by Yonhap, The Asia Business Daily, DigitalToday, ChosunBiz and Newsworks, the company said an internal investigation with the Korea Financial Security Institute found eight types of customer data had been exposed. These include names, email addresses, home addresses and several encrypted account and phone numbers. The intrusion was detected on 17 October. Daishin says it has found no evidence so far that customers have suffered follow-on harm, and that the attacker did not reach its core business systems. No threat actor has been named or has claimed the attack.
What Happened
Every outlet gives the same timeline, and all of it comes from the company's own statement:
- 17 October: Daishin detected signs of abnormal access by a hacker on a linked server used for remote ("non-face-to-face") account opening for discretionary investment services. Its emergency response included immediately blocking the IP address used in the attack and a second set of IP addresses the attacker used to get around security controls.
- Reporting: The company says it reported the incident to financial regulators right away. It then worked with the Korea Financial Security Institute to establish whether personal and credit information had been taken, and how much.
- Investigation: According to DigitalToday and Newsworks, investigators spent about 10 days reviewing more than 60,000 signals that had been disguised as normal service traffic.
- 26 October: The scope of the leak was confirmed.
- 28 October: Daishin disclosed the breach publicly. Chief Executive Jin Seung-uk said the company takes the leak "very seriously" and apologised to customers.
On the record count, accounts agree. Yonhap's headline and others round it to "some 38,000", but every report that gives an exact figure says 38,490. Newsworks describes this as 38,490 "pieces of information" rather than people. The other outlets, and the company's own wording as they report it, say 38,490 customers.
Accounts differ a little on customer notification. Newsworks says Daishin "has informed" affected customers. The Asia Business Daily, DigitalToday and ChosunBiz say the company plans to notify each customer individually. ChosunBiz adds that Daishin intends to compensate customers who suffer losses from the leak "in accordance with laws and procedures."
What Was Taken
The Asia Business Daily, DigitalToday, ChosunBiz and Newsworks all list the same eight data types:
- Customer name
- Email address
- Residential address
- Telecommunications ID
- Bank name
- Deposit and withdrawal account number (encrypted)
- Daishin Securities comprehensive account number (encrypted)
- Mobile phone number (encrypted)
Yonhap's shorter report lists mobile phone numbers among the leaked data without mentioning that they were encrypted. The fuller reports all say the phone numbers were encrypted, along with both account numbers.
The unencrypted fields (name, email, address, telecom ID and bank name) are enough on their own for targeted phishing and impersonation. An attacker who knows a victim's real name, home address and which bank they use can write a convincing fake message from the brokerage or the bank. None of the reports say how the encrypted fields were protected or whether the encryption keys could have been exposed. Until Daishin says otherwise, defenders should not assume those fields are permanently safe.
Why It Matters
This breach is part of a run of financial-sector intrusions in South Korea this month:
- KB Kookmin Bank: The Seoul Economic Daily reported on 27 October that the number of people exposed in an earlier breach jumped almost 19-fold, from 119 to 2,210, after a detailed re-examination. The bank said this was not a new attack. The extra victims, 1,631 customers and 460 staff, were found by going back over data from the original incident.
- Mirae Asset Life Insurance: The insurer said it detected irregularities on 25 October in its customer application system and parts of its website. The Seoul Economic Daily reports that the Financial Supervisory Service has launched an urgent inspection.
The KB Kookmin case is a warning about Daishin's 38,490 figure. Early counts in these incidents have gone up. Daishin's number comes from 10 days of traffic analysis, and it could change if investigators find more.
Staffing is also part of the picture. On 6 October, MoneyToday reported figures from the Financial Supervisory Service, submitted to lawmaker Park Hong-bae. They show Daishin's dedicated information security staff fell from five in 2021 to four in the first half of 2026, while several larger competitors grew their teams. Across South Korea's top 10 brokerages, security staff made up only 9.78% of IT personnel, the sixth year in a row in the 9% range. The same report said outside hacking groups had recently been scanning domestic securities firms for vulnerabilities. That was eleven days before Daishin detected its intrusion. No report has linked that scanning to this breach.
Victims also have little guarantee of compensation. In a commentary on 26 October, the Seoul Economic Daily noted that South Korea's Personal Information Protection Act requires companies above a certain size to carry liability insurance or set aside reserves, yet only about 1.6% of the up to 380,000 companies that may be covered actually hold such policies. Daishin's compensation pledge matters for that reason, although the company has given no detail on how it will work.
The Attack Technique
The company has disclosed little technical detail. What is known:
- Entry point: a server connected to (described as "linked to") the remote account-opening system for discretionary investment accounts. This is an internet-facing interface that collects identity and banking details from new customers. Daishin's pledge to "step up checks for security vulnerabilities in external interface systems" suggests the weakness was in this connected integration layer.
- Hiding in normal traffic: investigators had to sort through more than 60,000 signals disguised as legitimate service traffic. That means the attacker was pulling data through what looked like normal application requests, not using noisy exploits or bulk transfers.
- Getting around security controls: Daishin blocked both the attack IP and separate addresses used for "bypass access". This indicates the attacker used more than one source address, probably to slip past IP-based restrictions or rate limits.
- Containment: the company says the attacker did not gain access to core business systems.
Daishin has not said what vulnerability was exploited, how long the attacker had access before 17 October, or whether any ransom demand was made. No group has claimed the attack and no regulator findings have been published.
What Organizations Should Do
- Inventory and harden the systems around onboarding. Remote account-opening, KYC and partner integration servers collect valuable identity data and are often secured less tightly than core systems. Give them the same access controls, patching schedule and penetration testing as the systems they feed.
- Watch for data being pulled through normal-looking requests. Set baselines for how many records each session, IP and API key normally retrieves, and alert on anything unusual. An attacker who can disguise tens of thousands of requests as normal service traffic will not trip signature-based tools.
- Do not rely on IP blocking alone. Daishin's attacker had separate bypass addresses. Pair IP controls with device fingerprinting, mutual TLS or signed requests between integrated systems, and per-client rate limits.
- Encrypt more fields and keep the keys separate. Names, addresses and bank names were stored or sent unencrypted here. Minimise or tokenise identity fields wherever the workflow allows, and keep encryption keys out of reach of the application servers.
- Plan for the count to change. As the KB Kookmin case showed, initial breach counts can grow. Keep enough logs, and keep them long enough, to rebuild the full scope of an incident, and tell regulators and customers that the figure may be revised.
- Prepare customers for phishing. Exposed names, addresses and bank details are ideal material for fake brokerage and bank messages. Warn affected customers through official channels about what you will and will not ever ask for, and put extra verification on account changes for the exposed group.
Sources: Personal data of some 38,000 customers at Daishin Securities leaked... | Daishin Securities Apologizes for Leak of More Than 38,000 Customer... | Daishin Securities data of 38,490 customers leaked; no signs of sec... | Daishin Securities discloses 38,000-customer data leak, pledges saf... | Trading volumes surge, security stagnates… Hackers ... | Korea's Data Breach Safety Net Exists Only on Paper | KB Bank Data Breach Victims Jump to 2210 From 119 | 뉴스웍스