Account numbers of about 3,800 customers and personal data of 35,255 staff exposed

Breach reported to financial regulators Friday night; access routes blocked

Co-CEOs Kim Mi-seop and Heo Seon-ho apologize; no financial losses confirmed

The headquarters of Mirae Asset Securities [Mirae Asset Securities]
The headquarters of Mirae Asset Securities [Mirae Asset Securities]

Mirae Asset Securities has reported a hacking incident to financial regulators after personal data belonging to more than 39,000 customers and employees was leaked. The company said no financial losses have been confirmed so far.

According to financial industry sources, Mirae Asset Securities filed a report with regulators Friday night disclosing the data breach. The incident stemmed from external attacks on Wednesday and Thursday targeting the company's mobile web phone-authentication login service and its groupware system, mi-global.

The breach exposed account numbers belonging to about 3,800 customers. However, the company said other sensitive information, including account holder names, was not compromised.

Employee data was also leaked on a large scale. Information belonging to 35,255 people — including former employees and contractors — was exposed.

The leaked employee data consisted mainly of names and staff identification numbers, though email addresses, mobile phone numbers and encrypted passwords of some employees were also included. Unique identifying and sensitive information — such as resident registration numbers, passport numbers, driver's license numbers and alien registration numbers — was not leaked, according to the company.

Mirae Asset Securities blocked the relevant access routes and activated an emergency response system immediately after detecting signs of abnormal access from external IP addresses. The company also reported the incident to the Financial Services Commission, the Financial Supervisory Service and the Personal Information Protection Commission.

"This was a case of unauthorized external access to data, with no malware infection or service disruption," a company official said. "No financial losses have been confirmed to date, and our key systems and services are operating normally."

Cyberattacks targeting Mirae Asset Group affiliates have been occurring in quick succession. Mirae Asset Life Insurance suffered a customer data leak on Oct. 26, and attempted external intrusions were detected at Mirae Asset Global Investments and Energy Infrastructure Asset Management on Oct. 28 and Monday, respectively.

An on-site inspection found that about 6,800 people were affected by the Mirae Asset Life Insurance data leak. With Mirae Asset Securities now included, four Mirae Asset Group affiliates have been hit by cyberattacks in recent weeks.

The financial sector has seen a string of hacking attacks suspected to have involved AI agents. Beyond Mirae Asset, data breaches have also occurred at Daishin Securities and Hanyang Securities.

Financial regulators are reviewing the series of security incidents at Mirae Asset Group affiliates. Authorities are said to be weighing whether to dispatch an inspection team next week, taking into account the severity of the incidents and available personnel. If violations are found during the inspection, the case could be escalated to a formal investigation and those responsible could be held accountable.

Financial Supervisory Service Director Lee Chan-jin said regulators would examine whether financial firms affected by recent incidents had properly followed previously issued security guidelines and carried out their own internal checks. For large financial firms in particular, he said regulators intend to hold CEOs accountable, as they do with banks.

Mirae Asset Securities urged customers to be wary of phone calls, text messages and emails impersonating the company. The firm also opened a temporary counseling hotline for affected customers, operating Saturday from 10 a.m. to 5 p.m.

Co-CEOs Kim Mi-seop and Heo Seon-ho issued a joint statement apologizing to customers. "We again offer our deepest apologies for failing to fulfill our responsibility to protect your valuable personal and credit information," they said, adding that the company is investigating the cause and circumstances of the breach and working to prevent a recurrence.

Even when no direct financial losses are confirmed, data breaches at financial firms still warrant caution against secondary harm. Leaked information could be used in phishing or smishing attacks — fraudulent messages impersonating financial institutions or containing malicious links. When financially sensitive data such as account numbers is exposed, customers may find it difficult to distinguish legitimate communications from their financial institution from fraudulent ones, making vigilance especially important.


boo@heraldcorp.com