Mirae Asset Securities says external attackers exposed personal information linked to 39,055 customers and current or former workers in two incidents over consecutive days. The first intrusion affected about 3,800 customers, while the second involved 35,255 employees, former employees and outsourced personnel. The company has reported no confirmed financial loss, but the combination of account numbers and workplace contact details creates a risk that criminals could use accurate information to make impersonation attempts appear credible.
On Nov. 4, the brokerage detected abnormal external access to the mobile web service used for login through mobile phone verification. Account numbers belonging to about 3,800 customers were exposed. According to the companyโs account reported by multiple Korean news organizations, account holder names and other customer information were not included in that incident. Account passwords were also outside the reported exposure.
- Customer records
- About 3,800 account numbers exposed through the mobile web login service
- Workforce records
- 35,255 current and former workers and contractors affected through groupware
- Incident dates
- External access was detected on Nov. 4 and Nov. 5
- Confirmed financial loss
- None reported by the company at disclosure
A separate intrusion was identified on Nov. 5 in the companyโs internal groupware system, known as mi-global. That incident exposed information associated with 35,255 people, including current staff, former employees and outsourced workers. The fields differed by individual but could include names, employee identification numbers, email addresses, mobile phone numbers and encrypted passwords. The reported scope did not include resident registration numbers, passport numbers, driverโs license numbers or foreign resident registration numbers.
The headline total of 39,055 combines the approximately 3,800 customer records affected through the mobile service with the 35,255 people affected through groupware. The two figures describe different systems and categories of information. Customer exposure was reported as account numbers, while the workforce-related breach covered identity and contact fields held in an internal system. The available evidence does not provide technical detail showing whether the two intrusions were conducted by the same attacker or through the same vulnerability.
Two systems exposed different types of data
Mirae Asset Securities said it blocked the abnormal access route after detecting the activity and activated an emergency response system. It also said there was no malware infection, interruption to stock trading or disruption of its website and other customer services. No financial damage had been confirmed when the incidents were disclosed. Those limits reduce the evidence for direct account compromise, but they do not eliminate the possibility that exposed details could be reused in fraudulent messages or calls.
An attacker who knows a real account number, employee affiliation, email address or mobile number can incorporate that detail into a message impersonating a brokerage, colleague or financial authority. Recipients should therefore be cautious about unexpected requests to open links, disclose verification codes, reset credentials or transfer funds. The evidence does not establish that such secondary fraud has occurred, only that the disclosed information could make targeted approaches more convincing.
Accurate details can strengthen impersonation attempts
The brokerage reported the personal and credit information exposure to the Financial Services Commission, Financial Supervisory Service and Personal Information Protection Commission, according to the recovered reporting. It notified affected customers and workers individually and opened a consultation channel. The companyโs co-chief executives apologized for failing to meet their data protection responsibilities and said the cause, route of access and full scope would be investigated with the relevant authorities.
The disclosure follows reports of intrusions or attempted intrusions at other companies in the Mirae Asset group and at other securities firms, although the supplied evidence does not demonstrate a common attacker or a shared technical cause. Investigators now need to establish how each system was entered, whether any exposed files were copied or misused, and whether the initial count or list of compromised data fields changes. Mirae Asset Securities says it is conducting security checks and preparing measures intended to prevent a recurrence.