Daishin, Mirae Asset and Bithumb reported cybersecurity incidents on October 28, 2026.
Why it matters: The reports span securities, asset management and cryptocurrency, creating separate potential channels for customer-data loss. Authorities said no funds or payment, trading or withdrawal disruptions were reported.
- Daishin Securities said information on 38,490 customers was exposed on October 28, 2026.
- Bithumb reported a customer-information leak, while authorities inspected Mirae Asset without resolving whether data was taken.
- Regulators said suspected AI-assisted incidents affected 16 financial firms and approximately 100,000 personal records by October 14, 2026.
- South Korea plans vulnerability inspections of approximately 170 key private-sector IT infrastructures.
Daishin Securities, Mirae Asset Global Investments and crypto exchange Bithumb reported separate cybersecurity incidents on October 28, 2026. The reports came amid a wider run of attacks against South Korean financial institutions, but the available evidence does not establish that the October 28 incidents involved the same actor.
Yonhap reported that Daishin detected unauthorized access the previous week and said information on 38,490 customers, including names, email addresses and mobile phone numbers, was exposed. This is the clearest confirmed exposure among the three October 28 cases.
Bithumb said some customer personal information was leaked in an external cyberattack, according to the Yonhap report. Authorities also began an inspection of Mirae Asset; the company had not publicly confirmed whether customer data was taken. The same report said no funds were lost and no payment, trading or withdrawal disruptions were reported.
The incidents followed a late-September and early-October 2026 campaign that affected multiple financial organizations and involved copying data out of targeted systems. CrowdStrike said the activity used ARTEX, an open-source security-testing tool developed in China, alongside large language models. The firm assessed with moderate confidence that the operator was Chinese-speaking and financially motivated, but did not identify a named adversary.
South Korea's Financial Services Commission said suspected attacks using AI systems to automate parts of an intrusion had affected 16 financial firms and exposed approximately 100,000 personal records by October 14, 2026. The exposed information included names, contact details and resident registration numbers; regulators said there was no evidence at that time that account or card numbers had been compromised. A review of 555 firms found security deficiencies at 130, including missing patches, unsupported systems and weak safeguards for systems connected outside the organization.
Police opened a formal investigation on October 6, 2026, with 28 investigators assigned, Yonhap reported. The government said it would inspect around 170 key private-sector IT infrastructures, focusing on internet-connected pages and servers accessible from the public internet.
The caveat: The evidence does not establish that the October 28 incidents involved the same actor, or that AI autonomously conducted every stage of the earlier incidents.
By the numbers
- 38,490 - Daishin customers whose information the company said was exposed
- 100,000 - Approximate personal records regulators said were exposed by October 14, 2026
- 170 - Key private-sector IT infrastructures the government plans to inspect
Yes, but: The incidents should not be treated as one coordinated campaign: Daishin confirmed exposure, Bithumb reported a leak, and Mirae Asset was under inspection with the status of any data loss unresolved.
What's next: South Korea plans inspections of approximately 170 key private-sector IT infrastructures. The police inquiry opened on October 6, 2026, remains underway.