Oriental Living

Tag: cybersecurity

Mirae Asset Securities Breach Hits Data of 39,000 People
Mirae Asset Securities, South Korea’s largest brokerage, said Saturday that intruders had gained unauthorized entry into its systems, exposing information connected to around 39,000 people, according to Yonhap and The Korea Herald.

Photo by Bank OZK on Unsplash
Key facts
- Mirae Asset Securities disclosed on Saturday that data linked to roughly 39,000 people had been exposed, according to Yonhap and The Korea Herald.
- About 3,800 customer account numbers were among the compromised records, the firm said.
- Information on more than 35,000 current and former staff and contractors — including names, ID numbers, emails, phone numbers and passwords — was also exposed, Yonhap reported.
- The firm said it cut off the affected access points and alerted three financial regulators after spotting the intrusion.
- Korea Times noted the incident followed a similar leak days earlier at sister firm Mirae Asset Life Insurance, part of a broader wave of financial-sector breaches.
What happened

The firm said outside parties broke into two separate systems on consecutive days — first its mobile authentication login tool, then an internal network — allowing them to pull data out. Roughly 3,800 customer account numbers were taken, Yonhap reported, alongside records belonging to more than 35,000 people connected to the company as current or former staff members and outside contractors.

For that second group, the exposed material reportedly spanned full names, internal staff identification numbers, contact emails, mobile numbers and login passwords, according to Korea Herald and Korea Times accounts.

Why it matters

Mirae Asset holds a leading position among Korean brokerages, so an intrusion of this scale raises concerns about how well large financial institutions are guarding both client and workforce data. Exposed passwords and contact details can open the door to follow-up scams such as impersonation attempts or phishing messages aimed at those affected.

Our read: the fact that both customer and internal employee systems were breached within a two-day window points to a coordinated effort rather than an isolated glitch, underscoring why regulators are watching the financial sector’s cyber defenses closely right now.

Photo by Taylor Vick on Unsplash

Background

Mirae Asset told Yonhap it noticed unusual activity coming from outside IP addresses, moved quickly to seal off the compromised pathways, and switched on its internal emergency protocol. It also notified South Korea’s main financial watchdogs — the body overseeing financial policy, the one supervising financial institutions, and the agency responsible for personal data protection — about the incident.

According to Korea Times and Yonhap, this episode came only days after Mirae Asset Life Insurance, a related firm within the same corporate group, reported a comparable leak of its own. Citing the Financial Services Commission, Yonhap noted that over the past month more than 470,000 personal records have leaked across 37 financial firms, with stolen funds estimated around 1 billion won, roughly $745,000. Regulators said that since late September, 40 separate leak cases have surfaced at those 37 companies, covering four commercial banks, five financial investment firms, three insurers and five savings banks.

What to watch

Whether Mirae Asset’s containment steps prevent further misuse of the leaked credentials remains to be seen, and regulators may release more detail as their review continues. Given that several financial firms have now reported similar intrusions within weeks of each other, further disclosures from other companies in the sector would not be surprising.

This suggests authorities could move toward tighter rules on how brokerages and insurers secure login systems and internal databases, though no such measures have been announced yet based on current reporting.

Frequently asked questions

How many people were affected by the Mirae Asset Securities breach?

The company said data tied to about 39,000 people was exposed, including roughly 3,800 customer account numbers and records for more than 35,000 staff and contractors, according to Yonhap.

What kind of information was exposed?

For employees and contractors, the leaked items included names, staff ID numbers, email addresses, phone numbers and passwords, per Korea Herald and Yonhap reporting.

What has Mirae Asset done since discovering the breach?

It said it shut down the compromised entry points, triggered its internal crisis response procedure, and informed Korea's financial oversight bodies, according to Yonhap.

Sources
This article was prepared with AI assistance from the reports listed above and automatically checked against them. See About for how we work.
November 7, 2026
HYBE Data Breach Exposes Staff Medical, Financial Records
HYBE, the South Korean agency known for managing BTS, has confirmed that a cyberattack exposed sensitive personal data belonging to current and former employees as well as business partners, according to Korea Times. The leaked material reportedly included resident registration numbers, passport details, bank and credit card information, and medical records.

Photo by Albert Stoynov on Unsplash
Key facts
- HYBE, the agency behind BTS, disclosed a cyberattack affecting current and former employees and business partners, according to Korea Times.
- Breaches occurred in two windows: September 12-13 and October 3-5, per HYBE's apology cited by Korea Times and Koreaboo.
- Exposed data reportedly included resident registration numbers, passport numbers, bank and card details, medical records, addresses and phone numbers.
- HYBE has not disclosed how many people were affected, Korea Times reported.
- The company said it blocked the attackers' access routes and reported the incident to the Korea Internet and Security Agency and the Personal Information Protection Commission.
What happened

HYBE posted an apology on its website on October 18, saying an internal security review had detected unauthorized access traced to an outside vendor’s document preview tool connected to its electronic approval system, Korea Times reported. A follow-up investigation then uncovered similar unauthorized access in the company’s expense management system.

Per the company’s own account, cited by both Korea Times and Koreaboo, the intrusions happened in two separate windows: September 12 to 13, and October 3 to 5. Koreaboo reported more precise timestamps from HYBE’s notice, noting the first incident ran from early afternoon on September 12 into the following morning, while the second stretched from late evening on October 3 into the afternoon of October 5.

Beyond the headline categories of medical and financial records, the leak reportedly touched addresses, phone numbers, email addresses and dates of birth. Koreaboo added that depending on an individual’s role and approval history, some exposed files also contained IP addresses, employee numbers and department names.

Why it matters

The breach is notable both for who it hit and what it exposed. HYBE is described by Koreaboo as South Korea’s largest entertainment company, and the leaked categories go well beyond routine contact information into government ID numbers, passport data and health records — the kind of details that can enable identity theft or financial fraud if misused.

Our read: the combination of medical and financial data in one breach raises the stakes for affected individuals beyond typical corporate hacks, since this information is harder to change or protect after exposure than a password or email address.

Photo by Yoan on Unsplash

Background

This is not an isolated event for HYBE’s corporate ecosystem. Korea Times noted that the disclosure follows earlier privacy problems at HYBE’s subsidiary, Weverse Company, whose fan platform reported in September that information tied to 422,584 accounts had leaked, including internal identifiers and transaction records. A separate incident in January involved an employee improperly disclosing fan information, according to the same report.

Korea Times also placed the HYBE case within a broader pattern, pointing to data breaches at banks and other financial institutions in South Korea the previous month, reportedly linked to a cyberattack involving artificial intelligence. This suggests cybersecurity lapses are a recurring challenge across multiple industries in the country, not just entertainment.

What to watch

HYBE said it has blocked the internet addresses and access routes used by the attackers and has reported the incident to the Korea Internet and Security Agency and the Personal Information Protection Commission, according to Korea Times. The company is also in the process of notifying affected individuals directly and says no misuse of the leaked data has been reported so far.

Koreaboo reported that HYBE urged employees and partners not to respond to anyone impersonating the company or its staff requesting account details, money or sensitive materials, and warned against opening attachments or clicking links from unknown senders. The company also pledged to tighten access controls and monitoring systems to prevent a repeat.

Whether HYBE eventually discloses the number of people affected, and whether regulators take further action following the reports to Korean authorities, remain open questions. The outcome could influence how other K-pop agencies, many of which handle similarly sensitive data on staff, trainees and fans, approach their own cybersecurity practices going forward.

Frequently asked questions

What personal data was exposed in the HYBE breach?

According to HYBE's apology, leaked data included resident registration numbers, passport numbers, bank account and card details, medical information, addresses, phone numbers and dates of birth.

How did the hackers get in?

HYBE said an internal security check found unauthorized access through an outside vendor's document preview tool connected to its electronic approval system, with a similar intrusion later found in its expense management system, per Korea Times.

Has HYBE said how many people were affected?

No, Korea Times reported that the company did not disclose the number of people impacted by the breach.

Sources
- The Korea Times: HYBE data breach exposes employee medical records, financial details
- Koreaboo: HYBE Gets Hacked, Personal Information Leaked
This article was prepared with AI assistance from the reports listed above and automatically checked against them. See About for how we work.
November 2, 2026
North Korea Linked to Record $6.3B Binance Crypto Heist
Binance, the world’s largest cryptocurrency exchange, said on Oct. 30 that hackers made off with approximately $6.3 billion in digital assets, a sum Yonhap reported as $6.36 billion citing blockchain intelligence firm TRM Labs. Investigators have linked the breach to TraderTraitor, a hacking group tied to North Korea, in what analysts describe as the largest cryptocurrency theft ever recorded.

Photo by Kanchanara on Unsplash
Key facts
- Binance disclosed on Oct. 30 that roughly $6.3 billion in crypto was stolen, with Yonhap citing TRM Labs at $6.36 billion, the largest such theft on record
- TRM Labs says the group known as TraderTraitor took funds across 10 blockchain networks, with most of the haul moved in about 20 minutes after roughly 36 hours of preparation
- Around $2.7 to $3 billion of the stolen assets have reportedly been frozen through cooperation among crypto firms, while about $2.4 billion in Bitcoin and Ethereum remained with the hackers, per Yonhap
- Chainalysis says North Korea had already stolen at least $6.75 billion in crypto through the end of 2025, and researcher Michael Barnhart puts the regime's cumulative total near $13.5 billion after the Binance hack
- Bitcoin fell about 4% to the $78,000 range, its lowest in a month, and South Korea's Upbit warned users about withdrawals tied to Binance, BusinessKorea reported
What happened

According to TRM Labs, the attackers spent at least 36 hours preparing before striking, ultimately pulling funds from 10 separate blockchain networks and moving most of the stolen assets within roughly 20 minutes. The firm said it believes the hackers gained entry to systems that authorize cryptocurrency transfers, and BusinessKorea reported that the intrusion traced back to an unauthorized withdrawal path accessed through an engineer’s laptop. TRM Labs also raised the possibility that the signature system behind Binance’s internet-connected hot wallet had been compromised.

Binance halted deposits and withdrawals while reviewing its security and said customer funds remained safe, pledging to cover losses using insurance reserves and company funds. Co-CEO Richard Teng wrote on social media platform X that the exchange was working continuously to resolve the situation. Industry-wide cooperation has reportedly frozen between $2.7 billion and $3 billion of the stolen assets, according to TRM Labs and Binance, though Yonhap reported that hackers still held about $2.4 billion worth of Bitcoin and Ethereum, with concerns they could attempt to obscure the funds by shifting them across platforms and networks.

Why it matters

The theft dwarfs North Korea’s previous record haul, the $1.5 billion taken from exchange Bybit in February 2025, which U.S. authorities also attributed to TraderTraitor. Cybersecurity experts told Straits Times that proceeds from such thefts help finance North Korea’s weapons programs. The shock rippled through markets: Bitcoin dropped about 4% to the $78,000 range, its weakest level in a month, while stablecoin issuers Tether and Circle moved to freeze tokens tied to Binance, BusinessKorea reported. South Korea’s largest exchange, Upbit, told users to be cautious with transfers to Binance amid the fallout.

Photo by Markus Spiske on Unsplash

Background

TraderTraitor first drew formal attention in a 2022 joint advisory from the FBI, CISA and the U.S. Treasury, which detailed how the group used malicious software, bogus job postings and fake interviews to infiltrate developers and IT staff at crypto firms, extracting login credentials and sensitive data. Researcher Michael Barnhart of DTEX described the unit as North Korea’s most capable hacking operation, staffed by veterans of the regime’s former APT38 cyber ranks. Beyond Bybit, the group was also tied to a $387 million theft from exchange Bitget in September, and Chainalysis reported that North Korea had stolen at least $6.75 billion in crypto through the end of 2025 alone. Barnhart estimates the country’s cumulative crypto theft now stands near $13.5 billion. Yonhap noted that U.S. officials have previously said North Korea relies on overseas nationals and facilitators in countries including China, Russia, Cambodia and Vietnam to convert stolen assets into usable currency.

What to watch

Attention now turns to whether the roughly $2.4 billion still in hackers’ hands can be tracked or frozen before it is laundered through additional networks. Binance’s compensation process and the outcome of its security review will likely shape user confidence, while South Korea has seen separate incidents, including a breach of customer data at Bithumb and a smaller theft of around 100 million won, roughly $75,000, in virtual assets, according to BusinessKorea. Our read: the scale and speed of this attack suggest exchange security measures may need to evolve faster than the threat posed by state-linked hacking groups.

Frequently asked questions

How much was stolen from Binance?

Binance said on Oct. 30 that the theft totaled about $6.3 billion, while Yonhap reported blockchain firm TRM Labs put the figure at $6.36 billion, making it the largest crypto theft on record.

Who is blamed for the hack?

Blockchain investigators TRM Labs and Chainalysis attribute the attack to TraderTraitor, a North Korean hacking group also linked to the 2025 Bybit and Bitget hacks.

Has any of the stolen money been recovered?

Binance and partner firms say they have frozen between roughly $2.7 billion and $3 billion of the stolen funds, though around $2.4 billion in Bitcoin and Ethereum reportedly remained under the hackers' control, according to Yonhap.

Sources
This article was prepared with AI assistance from the reports listed above and automatically checked against them. See About for how we work.
October 30, 2026