Mirae Asset Securities Data Breach: About 39,000 People Exposed, Mostly Staff, and What Finance Firms Should Check This Week
Mirae Asset Securities says two attacks on November 4 and 5 exposed data on about 39,000 people, including 35,255 current and former staff. Here is what is confirmed, what is not, and what to check.
On this page 8 sections
Mirae Asset Securities, a South Korean brokerage, says outside attackers exposed data on about 39,000 people in two attacks on November 4 and 5, 2026. Most of those people are staff rather than customers, and the two systems involved were a mobile login service and an employee portal, which is why this matters to any business with systems facing the internet.
Mirae Asset Securities data breach: what happened
The company posted notices on its website on November 7, one for customers and one about the groupware attack. Together with Korean press coverage of those notices, they describe two separate events:
| Date | System attacked | People affected | Data exposed |
|---|---|---|---|
| November 4 | Mobile web phone-verification login service | About 3,800 customers | Account numbers; the company says account holder names were not taken |
| November 5 | mi-global, the company groupware | 35,255 current and former employees and outside contract staff | Names and employee numbers; for some people, email address, mobile number and encrypted password |
Added together, that is about 39,000 people. Some headlines give the impression that 39,000 customers were hit. The company's figures do not say that: roughly nine in ten of those exposed are staff or former staff.
Was customer data stolen? What is confirmed and what is claimed
Stated by the company in its notices: the two attacks, the systems involved, the headcounts and the types of data listed above.
Company claims nobody outside has verified yet, as reported by Hankook Ilbo and JKN:
- No resident registration, passport, driver's license or foreigner registration numbers were exposed.
- The intruder viewed data without authorization, with no malware infection and no disruption to trading or the main website.
- No direct financial damage has been confirmed so far.
- It blocked the access route on detecting abnormal access from an outside IP address, patched the weakness, and reported to the Financial Services Commission, the Financial Supervisory Service and the Personal Information Protection Commission.
Not known: who carried out the attacks, what the exact weakness was, how long the attacker had access, how the employee passwords were encrypted, and whether these attacks are linked to other incidents at the group. Korean press says recent attacks on the country's financial sector are suspected of using AI agents. Nothing we opened confirms that for this case.
Is this the first Mirae Asset hack?
No, but the earlier group incidents were not all the same kind of event.
Mirae Asset Life Insurance, an affiliate, confirmed a customer data leak, reported on October 26. Mirae Asset Global Investments is a different case. On October 28 it reported unauthorized outside access to some web systems, not a customer data leak, and said preliminary findings showed no sensitive personal, credit or investor information was compromised. Its investigation was still open at that point.
The regulator noticed the pattern. The chairman of the Financial Services Commission warned that some further incidents had happened inside corporate groups that had already had one, according to ZDNet Korea.
South Korea financial sector data breaches: the wider numbers
The Financial Services Commission published sector-wide figures on November 5:
- From September 30 to November 3, 37 firms reported 40 incidents.
- About 473,000 records were exposed. That is a count of records, not people, and the firms were not named.
- About 1 billion won was reported stolen, mainly from crypto hot wallets, consumable points and P2P lender deposit accounts. The regulator says individual users have not yet suffered actual losses.
- About 580 financial, e-finance and crypto firms face a full inspection. Registered internet-facing systems are due by November 30, and unregistered systems and internal controls by December 31.
Those totals stop at November 3, so the Mirae Asset Securities attacks on November 4 and 5 fall after the cut-off.
A second release on November 6 said no customer funds had been reported stolen through phishing or text scams tied to these leaks. Because more leaks had been confirmed, the special response period was extended to the end of December.
Why this matters for a company network or website
People tend to picture a brokerage hack as an attack on the trading engine. Based on what the company has disclosed, the exposed systems here were a login service on the mobile site and an employee portal. Those are the systems that often get less attention than the core product, yet they are reachable from the internet.
A staff directory is also useful to an attacker. Names, work emails, employee numbers and mobile numbers make convincing phishing messages and fake help desk calls possible, and former staff and contractors rarely hear a warning in time. Encrypted passwords may also be attacked offline, depending on how they were protected.
The Daily Secu report on the regulator's plan lists what inspectors will look at: staff management systems, internal business systems, partner systems, APIs, development and test servers, and temporary systems. That list works well for any company, regulated or not. If you run your own servers, self-hosted infrastructure needs the same inventory.
Financial sector cybersecurity: what to do this week
Mirae Asset Securities has not said how the attackers got in, so these are general precautions, not a fix for a known flaw.
If you run IT for a business
| Action | How to check |
|---|---|
| List everything reachable from the internet | Scan your own public IP ranges and domains, and compare the results with your asset register |
| Include forgotten systems | Look for test servers, temporary sites, partner portals and old APIs |
| Test login helper services | Confirm phone verification, password reset and account lookup pages return no data until the user is fully authenticated, and that they are rate limited |
| Take staff portals off the open internet | Put groupware behind a VPN or single sign-on with strong multi-factor login |
| Clean up the staff directory | Remove former employees and contractors, and limit what each account can see |
| Check password storage | Confirm passwords use a modern salted hash such as bcrypt or Argon2, not reversible encryption |
| Alert on unusual access | Review logs for abnormal outside IP addresses and bulk record lookups |
| Decide who can pull the plug | The Korean regulator expects firms to stop a service at once when a critical flaw is found, so name who makes that call now |
If your securities firm or bank is breached
- Change your password by typing the official address or using the official app, never through a link in a message.
- Review recent orders, balances and transfers.
- Treat calls and texts about the breach as suspect. Mirae Asset Securities warns customers it will never ask for passwords, one-time codes or security card numbers.
- In South Korea, the company's customer line is 1588-6800, and the regulator advises hanging up on suspicious calls and verifying them by calling 1394.
- Korean customers can also use the financial transaction safe-block service the regulator recommends.
Mirae Asset Securities data breach questions people are asking
Was Mirae Asset Securities hacked?
Yes. The company says outside attackers accessed a mobile login service on November 4 and its groupware on November 5, 2026.
How many people were affected?
About 39,000: around 3,800 customers and 35,255 current and former employees and contract staff.
Were passwords or national ID numbers exposed?
The company says encrypted passwords were exposed for some staff. It says resident registration numbers and similar identifiers were not exposed.
Was money stolen from customer accounts?
The company says no direct financial damage has been confirmed so far. That is its statement at the time of the notice, and the investigation continues.
Who was behind the Mirae Asset attack?
That has not been disclosed.
Is my trading platform at risk?
The company says trading services were not disrupted. Any platform is exposed through its login services, staff portals and partner connections, so ask your provider how those are protected.
The bigger lesson
The systems that get breached are often not the ones a company thinks of as its crown jewels. A login helper and a staff portal can expose thousands of people without touching the core product, so the inventory of what faces the internet is where security work starts.
Want that inventory done properly? See our security hardening service or request a quote.
Get security alerts by email, with the free checklist, at our security alerts page.
Sources: Mirae Asset Securities customer notice; Mirae Asset Securities groupware notice; Financial Services Commission, November 5; Financial Services Commission, November 6; JKN; Hankook Ilbo; Korea Herald; ZDNet Korea; Daily Secu.
Have a question about this article?
Ask it here and we will answer you directly by email. Questions are private, never posted.
Security alerts by email
Hear about the next one first.
When attackers start using a flaw in software businesses run on, we email what it is, whether it touches you and what to do that week, with a round-up of our latest security writing. Free, one-click unsubscribe. You get the checklist straight away: 12 things to secure this week.
Want a result like this?
Security alerts, breaches and the technology a business runs on: what happened, who it affects and what to do.
Get a Tech QuoteKeep reading
Aesto Data Breach: What Is Confirmed About the Healthcare Records Vendor, 4,508 South Carolina Residents, and What to Ask Your Vendors This Week
Patient records vendor Aesto says data may have been accessed or taken from its AWS systems in December 2025....
NBFC Cyberattack: Two Indian Lenders Report Over Rs 7 Crore Stolen Five Days Apart as CERT-In Warns of Payment API Attacks
Spandana Sphoorty and Keerthana Finserv reported Rs 7 crore-plus in unauthorised transfers five days apart. He...
AI Regulation Compliance: California's New AI Laws, the EU's New Deadlines, and How to Prove a Human Checked the Decision
California has limited AI-only firing and created a registry for AI auditors, and the EU has moved its high-ri...
