Moin, a South Korean overseas-remittance fintech, says an outside party broke into its systems and took files that customers had uploaded as supporting documents. The files include copies of resident registration cards, driver's licences, passports, bankbooks and family relation certificates. The breach happened on 23 October 2026. Moin found it six days later, on 29 October, and posted a public notice on 30 October. Moin has not said how many people or files are affected, so the size of the breach is unknown. The leak also reaches people who never used Moin: family members, household members, shareholders and business counterparties whose details appeared in other customers' documents. No threat actor has claimed the attack, and Moin has not named one.
What Happened
The timeline below comes from Moin's customer notice, as summarised by a Korean incident-tracking blog, and from ChosunBiz's report. The two accounts agree:
- 23 October 2026, about 02:30 KST: An outside party gains unauthorised access, and the supporting-document files leave Moin's systems.
- 29 October 2026, about 15:00 KST: Moin confirms the leak. The company says it found the breach while looking into unusual attempts to access its service.
- 30 October 2026: Moin publishes its notice.
Moin says it has closed the path the data left through and is investigating with an outside security firm. ChosunBiz reports that Moin has reported the incident to the Personal Information Protection Commission, the Korea Internet & Security Agency (KISA) and the Financial Supervisory Service. Neither regulator nor KISA has published its own findings yet.
The affected files are documents submitted before about 07:24 on 19 October 2023. Moin says its review of access logs shows that documents submitted after that point were not taken. This suggests the attacker reached an older archive or storage location rather than the live upload system, but Moin has not confirmed that.
Moin's own promotional activity ran alongside the incident. The company announced on 23 October, the day of the intrusion, that it had received payment patents from Samsung Electronics through a government technology-sharing programme. On 29 October, the day it confirmed the leak, it promoted an ATM-based remittance pilot with NICE Infra. Neither announcement is connected to the breach. They show a company growing into payments and offline channels while its older document store was exposed.
What Was Taken
Moin's notice says each person's exposure depends on which documents they submitted. The categories are:
- Identity documents: Resident registration cards, driver's licences, passports, alien registration cards, domestic residence reports, youth ID cards and Japanese residence cards. These carry names, resident or foreign registration numbers, addresses, dates of birth, sex, nationality, licence and passport numbers, card serial numbers and photographs.
- Bankbook copies: Account holder name, bank, branch and account number.
- Resident registration certificates: Names and resident registration numbers of everyone in the household, their relationship to the head of household, move-in dates and address history.
- Family relation certificates: Names, sex, dates of birth, resident registration numbers, family clan origin and registered home address for the customer and the relatives listed.
- Shareholder registers: Shareholder names, resident registration numbers, addresses, share types, holdings, ownership percentages and acquisition dates.
- Business registration certificates: Company names, registration numbers and representatives' names and dates of birth.
- Remittance supporting documents: Invoices, contracts and tuition bills, containing counterparties' names, addresses, phone numbers, emails, account numbers, transaction amounts and transaction details.
Moin says account passwords were not taken.
How many people are affected is unknown. Moin's notice gives no count of people or files, and ChosunBiz gives no figure either. Moin has not said whether the stolen data has been published or offered for sale.
This is about as sensitive as a document leak gets. A resident registration number is permanent, and in Korea it is the main key for identity checks. Pairing it with a photo ID, a bank account and a full family tree gives a fraudster almost everything needed to impersonate someone. Moin's customers include foreign residents and international students, so the leak also affects many non-Korean nationals, whose foreign registration and Japanese residence card data appears in the files.
Why It Matters
This breach follows a wave of attacks on Korean finance. Shinhan Bank disclosed on 30 September that about 25,000 customers' data had been taken. MoneyToday reports that KB Kookmin Bank leaked 119 customers' details through a hacked mobile system for employees that same week. Remio, an AI-focused blog, says intrusions or attempts were also reported at Hana, BNK Busan, Woori and NH Nonghyup banks, and that CrowdStrike linked part of that campaign to ARTEX, an open-source automated penetration-testing tool. Nothing published so far connects Moin to that campaign, so treat the overlap as context, not attribution. The pattern is still worth noting: in those bank cases, attackers went after supporting systems that sat outside the main banking platform. A store of old documents at a fintech is the same kind of target.
Remittance firms are being targeted globally. CyberSecureToday reports, citing state breach filings, that MoneyGram's September outage followed an intrusion in which attackers stole government IDs, bank account numbers and transaction histories. In early October, India's CERT-In warned fintechs and payment firms that attackers were stealing API credentials to move money directly. Remittance providers have to collect large amounts of identity paperwork to meet know-your-customer rules, and that paperwork is exactly what identity thieves want.
Old KYC documents are a liability. Every stolen file in this case was at least three years old. Data that firms must keep for compliance, or simply never delete, can do as much damage as live data.
The six days between intrusion and detection suggest Moin was not alerted when large volumes of files were read or downloaded.
The Attack Technique
How the attacker got in is unknown. Moin's notice describes only "illegal external access (hacking)". It does not name the entry point, the vulnerability, the tools used or the attacker, and says the root cause is still under investigation. ChosunBiz adds no technical detail.
What the evidence does support:
- The attacker reached stored document files, not account credentials. That fits access to a file store, an object-storage bucket or a document-serving endpoint, more than a compromise of the login system.
- The hard cutoff on 19 October 2023 means the attacker reached one bounded set of data, such as an older storage location, a legacy system or files that were moved during a migration.
- Moin found the breach while investigating unusual access attempts, which suggests the activity came through something reachable from the internet.
Until Moin or KISA publishes findings, any more specific explanation is guesswork.
What Organizations Should Do
- Inventory and shrink stored KYC documents. Find every place that holds ID scans, bankbooks and family certificates, including old buckets, migration leftovers and backups. Delete anything you no longer have to keep. Encrypt what you must keep, with keys held separately.
- Lock down document storage and retrieval. Make sure no storage bucket or file endpoint is public. Require access tokens that are short-lived and tied to a single file. Test direct object references for authorisation flaws, where changing an ID in a request returns someone else's file.
- Alert on unusual volumes of file reads. Set baselines for document downloads and alert on bulk or sequential access, especially to old data. Six days is too long to find an attack like this.
- Audit legacy and partner-facing systems. The Korean bank intrusions went through broker portals and staff tools, not core banking platforms. Apply the same authentication and rate limits to those systems as to customer-facing ones.
- Plan for harm to people outside your customer base. Moin's victims include relatives, shareholders and counterparties. Build a way to notify and verify them before you need it.
- Steps for affected individuals: Use Moin's email-verification page to check whether you are affected. Then:
- Get your ID card reissued.
- Register with the Financial Supervisory Service's system for people whose personal data has been exposed.
- Turn on the financial-transaction block service and an identity-theft protection service.
- Change your Moin Biz Plus password.
- Be wary of calls or messages claiming to come from Moin or a bank.
Sources: Moin data breach exposes Korean IDs and bank details after hack - C... | 2026.10.23 모인 해킹 및 개인정보유출 요약 :: 月光愛靑狼 | KB Kookmin Bank: Personal information of 119 customers leaked… "Ful... | MoneyGram Breach & Global Outage Forensics CyberSecureToday | MOIN Conducts ATM International Remittance Demonstration with NICE... | MOIN Secures Multiple Payment Patents from Samsung Electronics… Str... | CERT-In Warns NBFCs and Fintechs as Hackers Hijack Payment APIs for... | South Korean Bank Cyberattacks Expose a New AI Security Gap