[COVER STORY] Bithumb, Mirae Asset, Daishin join growing list of cyberattack victims

Daishin Securities, Bithumb and Mirae Asset Global Investments reported cyber incidents in Korea on Wednesday as attacks spread across the financial sector. Daishin said information belonging to 38,490 customers was compromised, while Bithumb is investigating whether customer data was exposed and Mirae Asset Global Investments said investor information was not affected. Authorities are investigating the breaches and cautioned that North Korean IP addresses alone do not establish who was responsible. The publicly identified total has reached 20 financial firms.

Daishin detected suspicious access on Oct. 17 to a server supporting online securities account openings for discretionary investment services and confirmed the leak after reviewing more than 60,000 signals disguised as legitimate service requests.

The compromised Daishin information included names, email and home addresses, login IDs, bank names, deposit and withdrawal account numbers, Daishin account numbers and mobile phone numbers; account numbers and mobile phone numbers were encrypted.

Bithumb said unauthorized access to its internal mobile groupware system exposed employee information, and it is investigating whether customer data was also affected.

Regulators detected more than 4.4 million scanning attempts beginning at 3 a.m. on Oct. 21, with most identified IP address ranges classified as North Korean; scanning can precede an intrusion but does not itself establish a breach.

After a detailed review with the FSS, KB Kookmin Bank raised its reported number of affected people from 119 to 2,210, including 1,631 customers and 460 employees.

Published Oct 28, 2026 10:17 am KST

Updated Oct 28, 2026 5:40 pm KST

Suspected AI-assisted attacks spread across financial sector, affecting at least 20 companies

A man sits in Bithumb Lounge in Seocho District, Seoul, Monday. Yonhap

Brokerage firm Daishin Securities, cryptocurrency exchange Bithumb and asset manager Mirae Asset Global Investments have become the latest victims of cyberattacks sweeping the country's financial sector, putting firms and regulators on heightened alert.

The suspected artificial intelligence (AI)-assisted attacks, first reported in the banking sector late last month, have spread across the financial sector, fueling customer concerns about financial firms’ ability to detect and respond to attacks.

While financial authorities are investigating how the recent breaches occurred and who was responsible, large-scale scanning attempts targeting financial systems from North Korean internet protocol (IP) address ranges have been confirmed for the first time. Authorities, however, cautioned against linking the recent attacks to North Korea.

"IP addresses alone cannot establish an attacker’s nationality or affiliation because address information can be manipulated and traffic routed through other locations," an official at the Financial Security Institute (FSI) said.

Daishin said on Wednesday that personal and credit information belonging to 38,490 customers had been compromised.

The brokerage first detected suspicious access to a server supporting online securities account openings for discretionary investment services on Oct. 17. It blocked the attackers’ IP addresses, reported the incident to regulators and began investigating with the FSI.

A review of more than 60,000 signals disguised as legitimate service requests confirmed the data leak. The compromised information included customer names, email addresses, home addresses, login IDs, bank names, deposit and withdrawal account numbers, Daishin account numbers and mobile phone numbers. The account numbers and mobile phone numbers were encrypted, the company said.

Daishin said it had found no signs that the leaked information had been misused or that its core business systems had been compromised, adding that it will inform affected customers and compensate any who experience losses as a result of the breach.

Bithumb also suffered a breach, according to an official at the Financial Supervisory Service (FSS) on Wednesday. The company said it discovered on Tuesday that personal information had been leaked following unauthorized access to its internal mobile groupware system. The information known to have been compromised so far concerns employees, but the exchange is investigating whether customer data was also exposed.

Mirae Asset Global Investments also said Wednesday that it activated its emergency response procedures and blocked access routes after detecting suspicious activity from external IP addresses on some web systems.

The asset manager said no unique identification data, sensitive information or personal credit information had been found to be compromised. The affected systems do not serve individual customers, so investor information was not affected, it added.

The latest disclosures followed a breach at Mirae Asset Life Insurance, which detected unusual activity in some systems Sunday and initiated an emergency response. It was the first insurer confirmed to have been affected in the most recent wave of attacks.

From left, KB Kookmin Bank CEO Lee Hwan-ju, Shinhan Bank CEO Jung Sang-hyuk, Hana Bank CEO Lee Ho-seoung, Woori Bank CEO Jung Jin-wan and NH NongHyup Bank CEO Kang Tae-young attend an audit at the National Assembly in Seoul, Oct. 19. Yonhap

Authorities have not ruled out the possibility of attacks on other firms, as investigations continue into how the attackers gained access and what information was compromised.

FSS Gov. Lee Chan-jin called for stronger information technology (IT) security at a meeting with the board chairs of eight banking groups on the day.

“As AI is used as a hacking tool, security vulnerabilities will become easier to identify and simultaneous attacks will become routine,” Lee said. “Boards should take the lead in strengthening IT security capabilities, recognizing that IT security is a core responsibility for protecting customers’ assets and information and maintaining trust in the financial system.”

Separately, regulators warned financial companies on Oct. 21 after detecting more than 4.4 million scanning attempts starting at 3 a.m. that day, with most identified IP address ranges classified as North Korean.

Scanning checks systems for open network ports and vulnerabilities that could allow unauthorized access. It can precede an intrusion but does not by itself mean a system has been breached.

The FSS similarly warned in an Oct. 6 notice that “some IP addresses cannot be linked to a specific country,” adding that even identifiable locations may reflect indirect routing.

Attacks spread, companies fail at early detection

Nearly a month after a breach at Shinhan Bank was reported to authorities on Sept. 30, cyberattacks have been confirmed across most major financial segments.

On Oct. 14, the Financial Services Commission and the FSS reported breaches at 16 companies and institutions, involving about 100,000 records containing customer information.

The affected firms included four banks — Shinhan, KB Kookmin, BNK Busan and Hana — and four savings banks — Yegaram, Welcome, DB and OK. Hyundai Capital and KDB Capital were among the affected credit finance companies.

Others on the list included peer-to-peer lenders PFCT and Mouda; electronic financial services provider Brightfix; cryptocurrency businesses Streami and Pravang; and the Korean Federation of Community Credit Cooperatives.

The disclosures by Daishin, Bithumb, Mirae Asset Global Investments and Mirae Asset Life Insurance bring the publicly identified total to 20.

More worryingly, additional leaks uncovered during follow-up reviews have raised doubts about the accuracy of financial firms’ initial findings and their ability to respond to breaches.

KB Kookmin Bank said Monday that it found information belonging to another 2,091 people had been exposed after detailed review with the FSS, taking the total from 119 to 2,210, about 18.6 times the initially reported figure. The newly identified cases involved 1,631 customers and 460 employees.

Financial Supervisory Service (FSS) Gov. Lee Chan-jin speaks during a meeting with the board chairs of eight banking groups at FSS headquarters in Seoul, Wednesday. Yonhap

Lawmakers also questioned KB Kookmin’s and Shinhan’s initial responses during an Oct. 19 National Assembly audit.

KB Kookmin was first attacked at 11:19 p.m. on Sept. 27, but classified the activity as routine abnormal traffic and responded only by blocking the IP address. It subsequently faced further attacks.

Shinhan took about 15 hours and 26 minutes to detect an attack that began at 6:04 p.m. on Sept. 28, identifying it at 9:30 a.m. the next day. Further attacks followed, resulting in the leak of 25,727 records containing customers' personal information.

Major banks plan bigger cybersecurity budgets for 2027

CEOs of major banks grilled at Assembly audit over AI cyberattacks

AI-driven cyberattacks hit 16 financial firms, expose 100,000 records

周三，韩国大信证券、Bithumb和未来资产环球投资公司报告了多起网络安全事件，攻击范围已蔓延至整个金融行业。大信证券表示，38490名客户的信息遭到泄露；Bithumb正在调查客户数据是否被泄露；未来资产环球投资公司则表示，投资者信息未受影响。当局正在调查这些安全漏洞，并提醒公众，仅凭朝鲜IP地址无法确定攻击者。目前已公开确认的受影响金融机构总数已达20家。

10 月 17 日，大真证券检测到对支持在线证券账户开立（用于全权委托投资服务）的服务器的可疑访问，并在审查了 6 万多条伪装成合法服务请求的信号后，确认了数据泄露。

泄露的大信银行信息包括姓名、电子邮件和家庭住址、登录 ID、银行名称、存款和取款账号、大信银行账号和手机号码；账号和手机号码均已加密。

Bithumb表示，其内部移动群件系统遭到未经授权的访问，导致员工信息泄露，该公司正在调查客户数据是否也受到影响。

监管机构从 10 月 21 日凌晨 3 点开始检测到超过 440 万次扫描尝试，其中大多数已识别的 IP 地址范围被归类为朝鲜；扫描可能先于入侵发生，但扫描本身并不构成入侵。

在与金融监督院进行详细审查后，国民银行将受影响人数的报告数量从 119 人增加到 2210 人，其中包括 1631 名客户和 460 名员工。

发布于2026年10月28日上午10:17（韩国标准时间）

更新于2026年10月28日下午5:40（韩国标准时间）

疑似人工智能辅助攻击蔓延至金融领域，至少20家公司受到影响。

周一，一名男子坐在首尔瑞草区Bithumb Lounge酒吧内。（韩联社）

证券公司大真证券、加密货币交易所 Bithumb 和资产管理公司未来资产环球投资已成为席卷日本金融领域的网络攻击的最新受害者，这让各公司和监管机构提高了警惕。

上个月底，银行业首次报道了疑似人工智能（AI）辅助攻击事件，这些攻击已经蔓延到整个金融领域，加剧了客户对金融公司检测和应对攻击能力的担忧。

尽管金融监管机构正在调查近期数据泄露事件的发生原因和责任人，但首次证实，来自朝鲜互联网协议（IP）地址段的大规模扫描尝试确实针对金融系统。不过，监管机构告诫不要将近期攻击与朝鲜直接联系起来。

“仅凭 IP 地址无法确定攻击者的国籍或所属机构，因为地址信息可以被篡改，流量也可以通过其他位置进行路由，”金融安全研究所 (FSI) 的一位官员表示。

大新银行周三表示，38490名客户的个人和信用信息遭到泄露。

该券商于 10 月 17 日首次发现对支持在线证券账户开设（用于全权委托投资服务）的服务器的可疑访问。它封锁了攻击者的 IP 地址，向监管机构报告了该事件，并开始与金融服务管理局 (FSI) 一起进行调查。

对超过6万条伪装成合法服务请求的信号进行审查后，证实了数据泄露事件。泄露的信息包括客户姓名、电子邮件地址、家庭住址、登录ID、银行名称、存款和取款账号、大信银行账号以及手机号码。该公司表示，账号和手机号码均已加密。

大真表示，目前尚未发现泄露的信息被滥用或其核心业务系统遭到破坏的迹象，并补充说，将通知受影响的客户，并对因此次泄露事件而遭受损失的客户进行赔偿。

据韩国金融监督院（FSS）一位官员周三透露，Bithumb也遭遇了数据泄露事件。该公司表示，周二发现其内部移动群件系统遭到未经授权的访问，导致个人信息泄露。目前已知泄露的信息涉及员工，但该交易所正在调查客户数据是否也遭到泄露。

Mirae Asset Global Investments周三也表示，在检测到某些网络系统上来自外部IP地址的可疑活动后，该公司启动了紧急响应程序并封锁了访问路径。

该资产管理公司表示，未发现任何唯一身份识别数据、敏感信息或个人信用信息遭到泄露。该公司补充说，受影响的系统不服务于个人客户，因此投资者信息未受影响。

最新披露的信息源于未来资产人寿保险公司（Mirae Asset Life Insurance）遭遇的网络攻击。该公司周日检测到部分系统存在异常活动，并启动了紧急响应。它是最新一波网络攻击中首家被证实受到影响的保险公司。

10月19日，KB国民银行CEO李焕柱（左）、新韩银行CEO郑相赫、韩亚银行CEO李浩升、友利银行CEO郑镇完和NH农协银行CEO姜泰荣在首尔国会出席审计活动。（韩联社）

当局尚未排除其他公司遭受攻击的可能性，目前仍在调查攻击者是如何获得访问权限的，以及哪些信息遭到泄露。

金融安全局局长李灿镇当天与八家银行集团的董事会主席举行会议，呼吁加强信息技术（IT）安全。

李表示：“随着人工智能被用作黑客工具，安全漏洞将更容易被识别，同时发起的攻击也将变得司空见惯。董事会应率先加强信息技术安全能力，认识到信息技术安全是保护客户资产和信息、维护金融体系信任的核心责任。”

另外，监管机构在 10 月 21 日向金融公司发出警告，称当天凌晨 3 点开始检测到超过 440 万次扫描尝试，其中大部分已识别的 IP 地址范围被归类为朝鲜的。

扫描会检查系统是否存在开放的网络端口和漏洞，这些漏洞可能导致未经授权的访问。扫描可能先于入侵发生，但扫描本身并不意味着系统已被攻破。

FSS 在 10 月 6 日的一份通知中也发出类似警告：“某些 IP 地址无法与特定国家/地区关联”，并补充说，即使是可识别的位置也可能反映间接路由。

攻击蔓延，企业未能及早发现

在9月30日新韩银行发生数据泄露事件并向当局报告近一个月后，大多数主要金融领域都证实发生了网络攻击。

10 月 14 日，金融服务委员会和 FSS 报告称，16 家公司和机构发生数据泄露事件，涉及约 10 万条包含客户信息的记录。

受影响的公司包括四家银行——新韩银行、KB国民银行、釜山BNK银行和韩亚银行——以及四家储蓄银行——艺嘉兰储蓄银行、惠康储蓄银行、DB储蓄银行和OK储蓄银行。现代资本和韩国产业银行资本也位列受影响的信贷金融公司之列。

名单上的其他公司包括：P2P借贷平台PFCT和Mouda；电子金融服务提供商Brightfix；加密货币公司Streami和Pravang；以及韩国社区信用合作社联合会。

大真、Bithumb、未来资产环球投资和未来资产人寿保险的披露，使得公开披露的总数达到 20 家。

更令人担忧的是，后续审查中发现的其他泄露事件，使人们对金融公司最初调查结果的准确性及其应对违规行为的能力产生了怀疑。

国民银行（KB Kookmin Bank）周一表示，经与金融监督管理委员会（FSS）详细审查，发现另有2091人的个人信息被泄露，使泄露人数总数从119人增至2210人，约为最初报告数字的18.6倍。新发现的案例涉及1631名客户和460名员工。

韩国金融监督院院长李灿镇周三在首尔金融监督院总部与八家银行集团的董事会主席举行会议并发表讲话。（韩联社）

议员们还对 KB Kookmin 和 Shinhan 在 10 月 19 日国会审计期间的初步回应提出质疑。

KB Kookmin 于 9 月 27 日晚上 11 点 19 分首次遭到攻击，但当时被判定为例行异常流量，仅采取了屏蔽 IP 地址的措施。此后，KB Kookmin 又遭遇了多次攻击。

新韩公司用了大约15小时26分钟才检测到9月28日下午6点04分开始的攻击，并在第二天上午9点30分确认了攻击身份。随后又发生了进一步的攻击，导致25727条包含客户个人信息的记录泄露。

各大银行计划在2027年增加网络安全预算。

在议会审计中，各大银行的首席执行官因人工智能网络攻击问题受到质询。

人工智能驱动的网络攻击袭击了16家金融公司，导致10万条记录泄露。