South Korean brokerage Hanyang Securities (KRX: 001750) has confirmed that someone gained unauthorized access to an external groupware solution it uses, and that customer and employee personal data was exposed. The company says it confirmed the leak on October 29, 2026. Chosun Biz, Seoul Economic Daily and Aju Press all reported it on November 3. The confirmed exposure so far is small: Aju Press puts it at 31 records in total. Three of those records contain resident registration numbers, which are South Korea's national ID numbers. The company says it is still investigating how far the breach reaches and when the attack began. Hanyang Securities has not named an attacker. It says it has reported the incident to the relevant authorities, but no regulator has published anything about it yet.
What Happened
Chosun Biz, Seoul Economic Daily and Aju Press all report the company's account the same way. Hanyang Securities found "abnormal access" to an external groupware solution and confirmed on October 29 that some information had leaked. Seoul Economic Daily attributes the access to "an external hacking attack" and says the breach came through the third-party groupware product.
Once it found the intrusion, the company says it:
- blocked external access to the groupware system
- installed an emergency security patch together with the groupware vendor
- reported the incident to the relevant authorities
- began notifying affected customers one by one
Seoul Economic Daily reports that the exact timing of the attack has not been established. That leaves open how long the attacker had access before the October 29 confirmation. The company has not named the groupware product or the vendor, and has not said whether the patch fixed a known vulnerability or a new one.
A Hanyang Securities official said: "We take this matter very seriously and sincerely apologize for causing concern to our customers." The official added that the company would review its security management system to prevent a repeat.
What Was Taken
All three outlets that covered Hanyang directly give the same breakdown of confirmed exposure:
- 15 customer records
- 2 employee-related records
- 14 records of "general personal information"
Aju Press adds these up to 31 records. Neither the company nor the other outlets have said whether the three categories overlap. The 31 figure should therefore be read as records, not necessarily 31 separate people.
The exposed fields differ from record to record. They include names, account numbers, contact details, addresses, dates of birth, email addresses, resident registration numbers and driver's license numbers. Every account agrees that three records include resident registration numbers. The reports differ on driver's license numbers. Chosun Biz and Seoul Economic Daily list them among the exposed fields generally. Aju Press says the three resident-registration records were also the ones carrying driver's license numbers. The company has not clarified which is right.
These counts are what has been confirmed so far, not a final total. The company says the scope is still under investigation.
Why It Matters
The number of records is small, but the breach is part of a wider pattern. Hanyang is the latest in a run of intrusions at South Korean financial firms that has spread from banks into brokerages, asset managers and crypto exchanges:
- Daishin Securities disclosed on October 28 that personal and credit data for 38,490 customers had leaked. Yonhap Infomax and Korea JoongAng Daily report that Daishin detected abnormal access on October 17, to a server linked to online account opening that it shares with an external partner. It confirmed the leak on October 26 after working with the Financial Security Institute.
- Mirae Asset Global Investments confirmed abnormal access from external IP addresses to some of its web systems. CrunchUpdates and Breach Signal report the company's early finding that no sensitive personal or investor data was compromised.
- Bithumb, the crypto exchange, said an unauthorized party broke into its internal mobile groupware system. CrunchUpdates, citing Blockchain Reporter, says that groupware runs on the third-party Daou Office platform and is physically separate from the trading network. Reports differ on what was taken. CrunchUpdates says the confirmed loss is employee information. Breach Signal says Bithumb has not confirmed whether customer records were taken, while Yonhap, citing an industry source, reported that customer data was exposed.
Earlier figures put the wave in context. Korea JoongAng Daily lists Yegaram Savings Bank at 43,246 affected customers, Shinhan Bank at 25,729 and KB Kookmin Bank at 2,210. Seoul Economic Daily reports that on October 14 the Financial Services Commission said breaches had been confirmed at 16 financial companies, and that 130 of 555 firms in a security checklist review reported deficiencies. Crypto Briefing, as cited by CrunchUpdates, links those 16 institutions to roughly 100,000 reported data leak cases. No regulator has confirmed that figure.
Korea JoongAng Daily reports that North Korean IP addresses were detected in the wave and that the earlier bank breaches are suspected to have used AI agents. Neither claim has been tied to Hanyang Securities. No attribution has been made for the Hanyang intrusion. Two firms reporting groupware compromises within days of each other is worth watching. However, nothing published so far shows that Hanyang and Bithumb use the same product or were hit by the same attacker.
For defenders, the lesson is that groupware is a real path to sensitive data. Systems built for email, messaging and document approvals often end up holding customer ID numbers and account details because staff pass them around in everyday work.
The Attack Technique
What is publicly known is limited:
- Entry point: an external, third-party groupware solution, according to the company as reported by Seoul Economic Daily.
- Fix: an emergency patch applied with the vendor. This suggests a flaw or misconfiguration in the vendor's product, but the company has not said so.
- Timeline: confirmed October 29. When the attack started is still under investigation.
The company has not disclosed how the attacker got in. It could have been an exploited vulnerability, stolen credentials or a compromised vendor account. It has also not said whether the attacker moved beyond the groupware into other systems. No indicators of compromise have been published.
What Organizations Should Do
- Treat groupware and collaboration platforms as systems that hold customer data. Find out what personal data is actually stored in messages, attachments and approval workflows, and limit or redact national ID numbers and account data in those tools.
- Patch third-party groupware quickly and confirm vendor updates are applied. Korean financial firms running vendor-hosted or on-premises groupware should contact their providers now to ask about recent emergency patches.
- Limit and watch external access. Put groupware behind VPN or zero-trust access, require phishing-resistant MFA, and alert on logins from unusual IP addresses and countries, especially on mobile groupware endpoints.
- Look back through logs. Hanyang has not established when its attack began, which shows how easily dwell time is missed. Review at least 90 days of groupware authentication, file access and bulk download logs.
- Review vendor and shared-system exposure. Daishin's breach came through a system shared with an external partner, and Hanyang's through a vendor product. List every third-party platform that touches customer data and check its access controls and logging.
- Prepare notification and response steps in advance. Have templates and regulator contact procedures ready for KISA, the Personal Information Protection Commission and the Financial Supervisory Service, so that blocking access, notifying regulators and contacting customers happen quickly.
Sources: Hanyang Securities reports Korea data breach after groupware hack -... | Hanyang Securities Hit by Hacking, Leaking Customer and Staff Data... | Hanyang Securities Confirms Data Breach Involving Personal Informat... | Hacking Incidents Hit Securities, Asset Management, and Crypto Sect... | هانيانغ للأوراق المالية تعاني من تسرب بيانات شخصية عبر نظام جماعي خ... | Bithumb confirms groupware breach as Korean firms disclose data leaks | Bithumb confirms breach of internal mobile groupware system | South Korea financial hacks hit Daishin Securities, Mirae Asset and...