Daishin, Mirae, Bithumb Hit in Fresh South Korean Finance Attacks
Daishin Securities reported on October 28, 2026 that a cyberattack exposed the personal information of 38,490 customers. The same day, Mirae Asset Global Investments and the crypto exchange Bithumb each reported separate cybersecurity incidents, without confirming that customer data had been taken. The three disclosures form a fresh wave of attacks on South Korea's financial industry, according to TechCrunch.
The Daishin breach exposed customer names, email addresses and mobile phone numbers. The data set contains no account credentials or financial account numbers, so the practical risk is identity-linked phishing and SIM-swap social engineering rather than direct account access. Officials were still investigating the root cause of the October 28 breaches as of that date.
The Financial Services Commission, South Korea's financial regulator, called for stronger cybersecurity measures after attacks on financial firms and government agencies. The regulator also planned security checks on dozens of private-sector IT systems. The checks are a plan, and their scope and timetable had not been completed.
The current wave follows a run of incidents that began in late September 2026. Security researchers linked the September attacks to a suspected China-based hacker using Artex, an AI-based penetration testing tool. The Straits Times reported in early October that suspicion had fallen on a single attacker using AI to breach financial firms, and that a wave of attacks had exposed personal data at seven firms at that point.
On October 4, President Lee Jae Myung ordered a probe into data leaks across the financial industry. An emergency meeting originally scheduled for October 7 was brought forward after additional breaches were found at second-tier financial institutions. The following day, Lee said AI appeared to have been used in the bank hacks. Police were investigating breaches at several major lenders at that time.
The count has grown since. As of October 14, South Korea had found hacking incidents at a total of 16 financial firms, and around 100,000 cases of customer data exposure had been identified across the sector, according to Reuters. On that same day, the Financial Services Commission held a meeting with officials from related organizations on cybersecurity management in the financial sector, with the stated purpose of bolstering anti-hacking measures.
South Korea has seen this kind of exposure before. Earlier, Lotte Card, which issues credit and debit cards, was breached between July 22 and August 2025. In April 2025, telecom operator SK Telecom suffered a cyberattack that led to the theft of personal data.
The broader context here is the data itself. Names, email addresses and mobile numbers are low-value individually, but combined across 16 firms and roughly 100,000 exposure cases, they make a usable corpus for targeted phishing and impersonation, particularly where the same identifiers are reused in one-time-password and account-recovery flows. The reporting attributes the campaign to tooling that automates reconnaissance and exploitation, which lowers the skill and time required per target. Whether the root cause of the October 28 incidents matches the September pattern is not yet established.
In my view, the more consequential question for the sector is less about any single intrusion than about whether the security checks on IT systems can keep pace with an attacker that can probe many firms in parallel. Regulators can mandate audits quickly. Verifying that the audited systems are actually hardened, and that customer-facing identifiers are protected against reuse in authentication, takes longer.
The same day, the commission held its seventh meeting on propelling a transition to inclusive finance, with officials from related organizations and private-sector experts. Officials discussed a comprehensive evaluation system for financial companies, with 17 domestic banks in three groups (large banks, small and medium-sized banks, and internet-only banks) subject to relative evaluation. The Financial Supervisory Service will oversee the process, and an evaluation committee chaired by a private-sector appointee will decide final results. Companies will be assessed annually on the previous year's performance, with results announced in March, and the system will extend to the non-banking sector from next year. Officials also discussed ways to strengthen management of non-performing loans at public financial institutions.
On October 26, the commission reported progress on benchmark rate reform since the plan was announced in March. KOFR-OIS transactions exceeded the 10 percent goal for the first-year period from July 2025 to June 2026, standing at 12.1 percent. They reached around 18.5 percent in the third quarter of 2026. The target for the second-year period, July 2026 to June 2027, is 25 percent, with a goal of 70 percent or more by June 2030.
The benchmark reform and the inclusive finance evaluation are separate tracks, but both appear on a regulator whose immediate agenda is now dominated by the breach wave. How quickly the commission converts its cybersecurity plans into verifiable controls will determine whether the sector's customer data exposure stops at the current tally.
