MediumII Cyber Warfare & Critical Infrastructure28 October 2026, Wednesday

Three more Korean financial firms report breaches as Seoul calls emergency talks

Daishin Securities, Mirae Asset Global Investments and the crypto exchange Bithumb reported customer data leaks in separate attacks on 28 October. At Daishin, the names, email addresses and phone numbers of 38,490 customers were taken. The presidential office called an emergency meeting the same day.

Location: SEOUL

According to a 28 October report in the Korea JoongAng Daily citing Yonhap, Daishin detected traces of unauthorised access a week earlier. The leaked data cover the names, email addresses and mobile phone numbers of 38,490 customers. Daishin has notified customers and said it will compensate them as required by law if they suffer losses. A Reuters report published in The Star on 28 October puts the figure at about 38,000.

Reuters says Bithumb's internal mobile system was hacked and personal information leaked; as of 28 October the exchange was checking whether member data had also been exposed. At Mirae Asset, financial authorities opened an inquiry on 28 October, and the number of affected customers has not been disclosed. Reuters could not immediately reach spokespeople for the three firms on 28 October.

On 28 October the presidential office convened an emergency meeting chaired by Song Ki-ho, the third deputy director of national security, with officials from the Financial Services Commission (FSC). The aim was to gauge the full extent of the damage and discuss steps to prevent further harm. In early October the FSC said the wave of attacks had hit 16 financial institutions, including banks, and caused about 100,000 data leaks.

The Science Ministry and the Korea Internet & Security Agency (KISA) urged site operators to check for PHP flaws that allow commands to run on a server without logging in. As of 28 October, the attack method and the identity of the attackers behind the three new breaches had not been disclosed. Whether the incidents are linked to the same perpetrator as the early October wave could not be verified.

Talay assessment

Bottom line

Escalation to the presidential office shows that a wave thought in early October to be confined to 16 institutions has spread to a brokerage and a crypto exchange. With the attacker and method undisclosed, it is unclear whether this is a single campaign or several actors exploiting the same PHP flaw. The most likely path is the FSC tightening mandatory audit and notification rules across the sector.

Likely effects

Korean brokeragesNegative1–6 months
Daishin's compensation pledge and likely inspections raise compliance and security spending across brokerages.
Crypto exchangesNegativeWeeks
A breach of Bithumb's internal system hurts customer confidence and invites closer oversight of exchanges.
Regional cyber policyUncertain1–6 months
Coinciding with the GMO wave in Japan in the same week, it accelerates financial regulators' focus on PHP and outsourced servers in both countries.

Possibilities, ranked

1
Mandatory sector-wide audit50%
The FSC and the presidential office require financial institutions to audit PHP and external access and to report breaches quickly.
Watch: An audit or notification rule announced by the FSC after the emergency meeting
2
The breach list grows35%
More institutions report breaches in the coming weeks, and the number hit rises above 19.
Watch: New breach notifications from financial firms and the FSC's updated count
3
Incidents stay contained15%
The three breaches remain separate, minor incidents, and no new notifications arrive in November.
Watch: No new breach notifications throughout November

Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.

Market reaction

Indicators affected

Records leaked at Daishin▼ 38,490
Institutions hit in October▼ 16+3

Bottom line

Likely effects

Possibilities, ranked

Sources