Mirae Asset Breach Exposes Customer Account Numbers, 35,255 Employee Records

South Korean financial services giant Mirae Asset Securities has disclosed a cyberattack that exposed account numbers belonging to approximately 3,800 customers and personal information relating to 35,255 employees, former staff members and outsourced workers.

The company confirmed the breach on Saturday, 7 November, following unauthorised access to two of its systems on 4 and 5 November. The incidents affected a mobile web login service and an internal employee communication platform.

The disclosure comes amid growing concerns over a series of cyberattacks targeting South Korea’s financial industry. Mirae Asset said it had blocked the affected access routes, informed regulators and launched an investigation to determine how the intrusion occurred.

How Hackers Gained Access To Mirae Asset’s Systems

According to the company’s disclosure, attackers targeted its mobile web phone-authentication login service on 4 November. A separate intrusion affected its internal groupware system, known as mi-global, on 5 November.

The mobile authentication service helps users access online financial services through phone-based verification. The internal groupware platform is used for workplace communication and administrative functions.

These systems handle different types of information, which helps explain why the exposed customer and employee records were not identical.

Mirae Asset said its security teams detected unusual attempts to access its systems from external internet protocol addresses. An IP address is a numerical identifier used by devices communicating over the internet.

Following the detection, the company blocked the suspected access routes and activated its emergency response procedures.

The brokerage said the incidents involved outsiders viewing information without authorisation. It reported no malware infection, interruption to trading services or confirmed financial losses at the time of its announcement.

The company also notified South Korea’s Financial Services Commission, Financial Supervisory Service and Personal Information Protection Commission. Affected customers and employees were separately informed of the incident.

What Information Was Exposed And Why Does It Matter?

The breach affected two distinct groups of people.

For approximately 3,800 customers, the exposed information consisted of brokerage account numbers. Mirae Asset maintained that account-holder names and other sensitive personal details were not compromised.

However, the employee-related breach was broader. Information belonging to 35,255 current and former employees, including outsourced personnel, reportedly included names, employee identification numbers, email addresses, mobile phone numbers and encrypted passwords.

The company said highly sensitive identification details, including South Korean resident registration numbers, passport numbers and driving licence numbers, were not exposed.

The distinction between ordinary passwords and encrypted passwords is important.

Encryption is a security process that transforms readable information into a protected form. A properly protected password cannot simply be read as ordinary text without overcoming the security measures applied to it.

However, the disclosure does not establish how the passwords were protected or whether attackers could eventually misuse them. The actual risk depends on the security methods used and the information obtained.

Employee contact details can also create opportunities for targeted fraud. Criminals may use genuine names, email addresses or workplace information to send convincing messages impersonating colleagues or company officials.

Such attempts are commonly known as phishing. They involve tricking people into revealing confidential information or visiting fraudulent websites by pretending to represent a trusted organisation.

There is currently no confirmed evidence that the stolen information has been used for further attacks.

Breach Adds To Wider Cybersecurity Concerns In South Korea

The incident follows other reported cyberattacks involving Mirae Asset group companies.

On 26 October, Mirae Asset Life Insurance disclosed a separate incident involving customer information. Other group businesses, including Mirae Asset Global Investments and Mirae Asset Energy Infrastructure Asset Management, subsequently reported attempted intrusions.

Together, these developments have raised questions about the security of interconnected financial businesses. However, authorities have not established that the incidents were conducted by the same attackers.

The broader financial sector has also experienced repeated security incidents.

According to figures cited by South Korean authorities, 37 financial institutions reported 40 cybersecurity incidents between late September and 3 November, involving approximately 4.7 lakh records.

Financial regulators have announced plans to examine security arrangements at around 580 financial companies as part of their response to the recent incidents.

Mirae Asset has apologised for failing to adequately protect the affected information and said it is examining the causes of the breach.

Investigators must still establish how the attackers entered the systems, whether additional information was accessed and whether the incidents are connected to other attacks targeting the financial sector.

The company’s disclosure does not establish that customers or employees of its Indian operations were affected.