MediumII Cyber Warfare & Critical Infrastructure7 November 2026, Saturday
Mirae Asset becomes the latest Korean broker to report a breach
Mirae Asset Securities said on 7 November that unauthorised access on 4–5 November had exposed data on about 39,000 people. Financial authorities say 40 incidents have hit 37 financial companies since 30 September.
According to the company, the attackers accessed its mobile web login service, which uses phone verification, on 4 November, and its internal messaging system on 5 November. IANS, citing Yonhap on 8 November, reported that account numbers of about 3,800 customers were leaked. The same report said the names, employee numbers, emails, phone numbers and passwords of more than 35,000 current and former employees and contractors were taken. The Layman Security puts that figure at 35,255. The company says passwords were stored encrypted but has not disclosed the method.
Mirae Asset reported the incident to three bodies: the Financial Services Commission (FSC), the Financial Supervisory Service (FSS) and the Personal Information Protection Commission. Four companies in the group have been affected in less than two weeks; Mirae Asset Life Insurance disclosed a breach on 26 October. Daishin Securities announced on 28 October that data on 38,490 customers had been leaked.
FSC data show 40 incidents reported at 37 companies since 30 September, with about 470,000 records leaked and stolen funds estimated at about 1 billion won. Regulators have launched a security review covering about 580 companies. As of 8 November the attacker's identity and method of entry had not been disclosed, and no official attribution to North Korea could be verified. Nor is there public data on whether the 1 billion won loss was covered by cyber policies or absorbed on balance sheets.
Talay assessment
Bottom line
The Mirae Asset breach shows that the wave hitting Korean finance is not confined to small firms. Forty incidents at 37 companies, and four companies within one group, may point to a common entry point; that link has not yet been confirmed. The most likely path is that the 580-company review turns into binding supervisory requirements in December.
Likely effects
- Korean financial regulationNegative1–6 months
If the 580-company review finds violations, it will turn into formal inspections and sanctions, raising compliance costs for brokers.
- Cyber insuranceNegative1–6 months
Forty incidents clustered in one period could tighten cyber cover terms for Korean financial firms at renewal; cover data are not public.
- Customer trustNegativeWeeks
The leak of 3,800 account numbers raises the risk of a second wave of phishing and account takeover attempts.
Possibilities, ranked
- 1Review becomes an inspection55%
The FSC and FSS find issues in the 580-company review and announce formal inspections and extra security requirements.
Watch: The FSC's review findings and a formal inspection announcement
- 2The wave continues30%
New breaches at brokers and insurers add to the 40 incidents during November.
Watch: Updated FSC incident and record counts
- 3A common source is found15%
The investigation shows the incidents came from a shared vendor or the same vulnerability, shifting liability to the vendor.
Watch: Disclosure of the entry method by Mirae Asset and the FSS
Probabilities are calibrated judgement based on the sources, not measurement, and are revised as new information arrives. Not investment advice.
Market reaction
Indicators affected
- People exposed▼ ~39,000
- Incidents in the sector▼ 40