Mirae Asset Securities, South Korea's largest brokerage, has confirmed that outsiders accessed its systems without authorization and leaked the account numbers of about 3,800 customers. The breach also exposed personal information on 35,255 current and former employees and contractors. The company disclosed the incident on its website on 7 November. Yonhap, the Seoul Economic Daily and Financial News all reported the disclosure. Mirae Asset Securities is now the fourth Mirae Asset Group company hit in a matter of weeks. It is also the latest in a run of breaches across South Korea's banks, insurers, brokerages, asset managers and cryptocurrency exchanges. The company says it has found no financial losses so far. No attacker has been publicly identified.
What Happened
According to the company's statement as reported by Yonhap, unauthorized external access took place on Wednesday 4 November and Thursday 5 November. Each day hit a different target:
- 4 November: the mobile web phone-authentication login service, the system customers use to sign in.
- 5 November: an internal system. Financial News identifies it as the company's groupware platform, "mi-global". The Seoul Economic Daily describes the affected assets as "some of its mobile web and groupware systems."
Mirae Asset Securities says it spotted suspicious access from external IP addresses, blocked the affected access routes straight away and activated its emergency response system. It has reported the incident to the Financial Services Commission, the Financial Supervisory Service (FSS) and the Personal Information Protection Commission.
The company stresses that this was not a malware infection and did not cause any system outage. In its account, outsiders who lacked legitimate access rights logged in and viewed internal data. It says its website and main financial services are running normally. Its current focus is working out exactly how the breach happened and how far it reached.
The incident follows a cluster of breaches across Mirae Asset Group. The Seoul Economic Daily reports that four affiliates have now been hit: Mirae Asset Life Insurance, Mirae Asset Global Investments, Mirae Asset Energy Infrastructure Asset Management and now Mirae Asset Securities. The paper calls this unprecedented for the group. On 28 October, Mirae Asset Global Investments disclosed a breach with a similar pattern: abnormal access from external IP addresses to internal web systems, with staff data such as names viewed. That company said no retail investor data was exposed and that it found no direct intrusion into servers or databases. Alpha Biz reports that Mirae Asset Life Insurance shut down its website after a customer data breach on 26 October.
What Was Taken
Outlets break the exposed data down in slightly different ways.
Customer data: Account numbers for about 3,800 customers. Financial News reports that no other sensitive information, such as account holders' names, appears to have leaked alongside those account numbers.
Employee and contractor data: Records on 35,255 current and former employees and outsourced workers. Exposed fields include: - Names - Employee ID numbers - Email addresses - Mobile phone numbers - Passwords
On passwords, the reports differ. Yonhap lists "passwords" without saying how they were stored. Financial News specifies "encrypted passwords." The company has not said publicly which hashing or encryption method it used.
Totals: The headline figures vary depending on how each outlet counts. Financial News adds the two groups together for a total of around 39,000 people. The Seoul Economic Daily describes "more than 35,000 records" that include the 3,800 account numbers. It is not clear from that wording whether the customer records sit inside the 35,000 figure or on top of it. Yonhap reports the two groups separately. Treating the 3,800 customers and the 35,255 staff as separate groups, as Yonhap and Financial News do, gives about 39,000 people affected.
Not exposed: The company says no unique identifiers leaked. That covers resident registration numbers, passport numbers, driver's licence numbers and alien registration numbers. It says no data classed as sensitive under Korean privacy law was exposed either.
Why It Matters
The staff data is the bigger long-term risk. The 3,800 account numbers sound alarming. On their own, without names or login credentials, they are of limited direct use. The employee data is more dangerous. A list of 35,255 names, employee IDs, corporate email addresses, mobile numbers and passwords is exactly what attackers need for targeted phishing, SMS phishing ("smishing"), password-spraying and help-desk impersonation against Mirae Asset and its affiliates. If the stolen passwords are weakly hashed, or are reused anywhere else, attackers could use them to log in as staff. The list also covers former staff and contractors, whose accounts are often the slowest to be disabled.
Inspections did not prevent the breaches. CHOSUNBIZ reports that Daishin Securities and a Mirae Asset asset management company were breached in October despite having passed the FSS's security checklist inspection. That has drawn criticism that the regulator's checks before the breaches achieved little. FSS Governor Lee Chan-jin has publicly warned that "cyberattacks are expanding to financial investment businesses" and has called for stronger IT security. The FSS has sent on-site inspection teams to affected firms.
The attacks span the whole sector. In October, Daishin Securities disclosed a breach affecting 38,490 customers. Bithumb, South Korea's second-largest crypto exchange, reported unauthorized access to its internal mobile groupware. Alpha Biz reports that authorities detected about 4.4 million suspicious access attempts from IP addresses associated with North Korea across the financial sector. That claim is reported by Alpha Biz alone. Neither regulators nor Mirae Asset Securities have publicly attributed this incident to any actor.
The Attack Technique
Technical details are limited. Mirae Asset has not published root-cause findings. What the reporting shows is a consistent pattern:
- Login and authentication endpoints were targeted directly. The first intrusion hit a mobile web login service that uses phone-based authentication. That points to a weakness in how sessions or identity checks are handled, such as broken access control, authentication bypass or automated abuse of the login flow. The company has not confirmed any of these.
- Groupware was a target, as at other victims. Groupware was the second target here. Bithumb also reported a breach of its internal mobile groupware. Mirae Asset Global Investments described a breach of internal web-based work systems. Groupware usually holds employee directories, which matches the type of data leaked.
- Data was viewed over the web, with no malware involved. Every Mirae Asset entity has described the incidents the same way: data viewed without proper authorization, no malware, no outage and, at Global Investments, no direct intrusion into servers or databases. That fits attackers exploiting weaknesses in web applications to pull data out. It does not fit a ransomware-style attack inside the network.
- The same pattern repeated across affiliates. Several group companies were breached within about two weeks, each through externally reachable web systems. That suggests either shared infrastructure or software, or attackers deliberately working through similar targets. Neither possibility has been confirmed.
Mirae Asset Global Investments said it fixed "the relevant vulnerability" and brought in an external security firm, but did not name the flaw. Mirae Asset Securities has not said whether it has taken the same step.
What Organizations Should Do
- Check access controls on internet-facing login and groupware systems. Test mobile web authentication flows, especially phone-verification steps, for authentication bypass, insecure direct object references and missing server-side authorization checks. Prioritise any web application that can show employee directory data or account data.
- Reset every credential that may be exposed. Force password resets for current staff and contractors. Disable accounts belonging to former employees and outsourced workers that are still active. Check that stored passwords use a modern, salted, slow hashing algorithm such as Argon2 or bcrypt. Simply "encrypted" is not good enough.
- Require phishing-resistant MFA on groupware and remote access. Leaked emails, phone numbers and employee IDs make convincing pretexting easy. Prefer FIDO2 or passkey-based authentication over SMS codes.
- Prepare staff and customers for targeted fraud. Warn employees about phishing and smishing that cites real employee IDs. Tell affected customers that their account numbers may be used in impersonation scams. Strengthen identity checks at the help desk and call centre.
- Watch for access patterns that look like data being harvested. Alert on unusual query volumes, sequential lookups of records, and logins from unfamiliar external IP ranges to web applications that reach internal data. Block or challenge known hostile IP ranges where appropriate.
- Share threat information across group companies and the sector. When one affiliate is hit, review shared platforms, vendors and software at the others straight away. Coordinate indicators with the FSS and peer institutions instead of waiting for each company to finish its own investigation.
Sources: Mirae Asset says data breaches exposed customer, employee informati... | Mirae Asset Securities Hit by Hacking, Leaking Client and Staff Dat... | Mirae Asset Securities Hacking Incident: Information of Around 39,0... | Mirae Asset Global Investments says data leaked from internal syste... | Hacks hit Daishin, Mirae as FSS checks fail, spur Korea security pu... | Mirae Asset Global Investments Hit by Hacking, Says No Client ID Da... | Hackers hit Mirae Asset Global Investments as Korea probes sector b... | Cyberattacks Spread Across South Korean Financial Sector as 4.4 Mil...