Saturday, 31 October 2026Global tech news & guides — what changed, and what it means for you.
AuTechWire
Original editorial illustration of a dark Seoul financial-district skyline at night: one office tower with a single floor glowing amber while the rest stays dark, and a thin stream of glowing data fragments drifting from that floor toward the street below

Daishin Securities Breach: 38,490 Customers Exposed

by

Daishin Securities Breach: 38,490 Customers Exposed

In brief

  • Daishin Securities confirmed a breach exposing 38,490 customers’ personal and account details. What was taken, what is still unknown, and what to do now.
  • Daishin detected signs of unauthorized access on October 17, 2026, on a server supporting remote account opening for discretionary investment services, and confirmed the leak on October 26.
  • Eight categories of information were exposed, including names, email addresses, postal addresses, bank names and account numbers, Daishin securities account numbers, and mobile phone numbers.
  • Two other South Korean financial firms disclosed incidents the same day, and police have opened a preliminary investigation — but no link between the cases, and no attribution, has been confirmed.

Last verified: October 29, 2026.

What happened

Daishin Securities, a South Korean brokerage, said on October 28, 2026, that personal and credit information belonging to 38,490 customers had been leaked. The disclosure was one of three from South Korean financial firms that day, and it landed in the middle of a month in which breaches across the country’s banks, savings banks and other financial businesses had become, in Aju Press’s words, more or less a daily affair.

The timeline Daishin gave is unusually specific, and it matters. The brokerage first detected signs of unauthorized access on October 17, on a server supporting remote securities-account opening for discretionary investment services — the system that lets customers open accounts without visiting a branch. It blocked the internet addresses used in the attack, including addresses used to bypass access restrictions, and notified regulators. Working with the Financial Security Institute, it then reviewed about 60,000 requests disguised as legitimate service traffic over a 10-day investigation, and confirmed the information leak on October 26. The public disclosure followed two days later.

That sequence — a peripheral, customer-facing server rather than a core trading system — is the pattern to notice. The server in question handles account openings, not trades or settlements, and it sits at the edge of the firm’s systems, where it must accept connections from the public internet. Security experts quoted in South Korean reporting warn that exactly these externally connected systems are the current targets: relatively weak servers linked to account openings or business-support networks, with the risk that an attacker who gets in there can probe deeper toward core internal networks. Daishin has not said its core business systems were accessed, and nothing in the reporting so far suggests trading or settlement systems were involved. That distinction is worth holding on to, because it defines what customers should worry about — and what they should not.

What was exposed

Daishin listed eight categories of exposed information: customer names, email addresses, postal addresses, communications IDs, bank names, bank account numbers, Daishin securities account numbers, and mobile phone numbers.

Read that list as an identity-theft kit, not as a single credential. No single item on it, on its own, lets an attacker log in to a brokerage account. Together, though, they let an attacker sound convincingly like the brokerage: a message addressed by name, referencing a real bank and a real account relationship, sent to a real email address or phone number, is far harder to dismiss than a generic phishing email. That is the realistic risk here, and it is also why the distinction between “data leaked” and “account compromised” matters. Daishin has said it will compensate customers in accordance with the law if the breach causes them damage, and that it has notified the affected customers. It has not reported that customer accounts were taken over, and no secondary harm has been confirmed in the reporting so far.

One reporting nuance deserves a plain statement rather than being smoothed over. Aju Press lists the eight categories without qualification, while Seoul Economic Daily describes the account and mobile phone numbers involved as encrypted. Those two descriptions are not necessarily in conflict — encrypted numbers can still be exposed as data while remaining unreadable without the key — but Daishin’s own disclosure, as reported, does not settle the question in public. Readers should therefore treat the account numbers as exposed information whose usability to an attacker is not yet publicly established, not as either confirmed plaintext or confirmed safe.

Three firms, one day — and questions nobody has answered yet

Daishin was not the only South Korean financial firm to disclose an incident on October 28. Mirae Asset Global Investments reported that abnormal access through an external IP address had reached some of its internal business systems; the firm said no personal credit information had been found to have leaked so far, and financial authorities have begun an inspection. Cryptocurrency exchange Bithumb reported that an unauthorized outside party had gained access to its internal mobile groupware system on October 27, leaking employee information; the exchange is still checking whether customer information was also taken, and no affected-user count has been disclosed.

It is tempting to read three disclosures on one day as one attack. The investigators have not said that. The National Office of Investigation at the Korean National Police Agency launched a preliminary inquiry on the morning of October 28 into all three breaches, assigning the case to the same team handling the earlier string of financial-sector hacks, and said it would compare the methods used in each case against the earlier incidents. Police have not ruled out the possibility that a single attacker targeted multiple institutions — and they have not confirmed any link between the cases.

Attribution is in the same unconfirmed state. Financial authorities said multiple North Korean IP addresses were identified in attacks that began on October 21, according to Seoul Economic Daily, but no breach has been traced to those addresses. An IP address appearing in an attack is not the same as an attack succeeding through it, and it is certainly not the same as attribution to a state actor. The presidential office’s National Security Office held an emergency response meeting on the incidents, chaired by its third deputy director, with officials from the relevant ministries and agencies reviewing the investigations and the measures taken at each firm. That is a measure of how seriously Seoul is taking the wave, not evidence about who is behind it.

The wave itself predates October 28. South Korea’s Financial Services Commission said on October 14 that cyber incidents had been identified at 16 firms, with roughly 100,000 records exposed — an interim tally, before the latest disclosures, with investigators still examining whether the attacks were connected. Daishin’s 38,490 customers sit on top of that figure, not inside it.

What this means for you

  • If you are a Daishin customer, expect the notification Daishin says it has sent, and treat any message claiming to be from Daishin about this breach with suspicion until you verify it through the firm’s official channels — the leaked data makes impersonation easier, not harder.
  • Watch for phishing that uses your name, your bank’s name, or your account relationship as its hook. A message that knows those details is not automatically legitimate; it may simply be built from this leak.
  • Check your bank and brokerage statements for transactions you do not recognize, and report anything unfamiliar promptly. Daishin has said it will compensate customers in accordance with the law if the breach causes damage — keeping a record of any loss or suspicious contact is what makes that promise usable.
  • Do not confuse a leaked account number with a compromised account. Your password and any second-factor method were not listed among the exposed categories, but if you reuse a password anywhere, or if you receive a convincing impersonation attempt, treat that as a reason to change it and to check your account’s security settings.
  • If you hold accounts at other South Korean financial firms, the same caution applies in general, but do not assume your data was exposed at Bithumb or Mirae Asset: neither firm has confirmed customer-data exposure, and assuming otherwise creates exactly the confusion attackers exploit.

What to watch next

Three questions will decide how serious this incident turns out to be. First, scope at the neighbouring firms: whether Bithumb’s investigation finds customer data was taken, and whether Mirae Asset’s inspection finds anything beyond internal business systems. Second, connection: whether police, comparing methods across the cases, find evidence that one attacker is behind several of them, or whether the cluster is a coincidence of timing in a month of heavy targeting. Third, attribution: whether any breach is traced to the North Korean IP addresses identified in the attacks, or whether that lead goes nowhere.

There is also a policy question running underneath all three. Critics in South Korean reporting argue that the failure to enact the Digital Finance Safety Act has made the damage worse, and that financial firms’ security governance — particularly the authority of chief information security officers and the use of automated defense such as attack-surface management — has not kept pace with attacks that now arrive simultaneously across sectors at a speed no human team can mount alone. Whether the October wave produces legislation, or merely another round of inspections, is the longer story behind the 38,490 figure.

For now, the confirmed facts are these: one brokerage, 38,490 customers, eight categories of personal and account data, a peripheral account-opening server as the entry point, and a police investigation that has not yet tied anything together. That is serious enough on its own. It does not need borrowed attribution or borrowed scope to matter.

Related reading

Sources

Shoaib Hassan

Shoaib Hassan is the founder and editor of AuTechWire, an independent technology publication covering broadband, mobile networks, privacy, startups, and consumer tech.

Related Stories

Leave a Comment