South Korea’s financial industry is confronting a fresh wave of cyberattacks, with brokerage Daishin Securities, asset manager Mirae Asset Global Investments and cryptocurrency exchange Bithumb disclosing separate security incidents on October 28.
Daishin Securities reported that personal and financial information belonging to 38,490 customers was exposed after unauthorized access to a server supporting its online account-opening service for discretionary investment products. The firm detected suspicious activity on October 17 and later examined more than 60,000 requests over a 10-day period that appeared disguised as legitimate traffic. Compromised details included customer names, email addresses, physical addresses, bank names and account numbers, along with encrypted phone numbers and account information.
Bithumb confirmed unauthorized access on October 27 to its internal mobile groupware system, which operates through a third-party platform. The exchange stated that the breach did not affect its core cryptocurrency trading platform or customer digital assets. Mirae Asset Global Investments reported unauthorized access to some of its business-use web systems, though it said retail investor information was not involved because the affected systems do not serve those customers and that no financial losses occurred.
Context from the September-October Wave
The latest incidents follow a series of cyberattacks that began in late September and continued into mid-October, affecting at least 16 South Korean financial institutions. Those earlier breaches exposed roughly 100,000 pieces of customer data across major banks including Shinhan Bank, KB Kookmin Bank and Hana Bank, as well as savings banks and credit finance firms. Security researchers, including CrowdStrike, linked the prior campaign to a suspected China-based actor who used an AI-assisted penetration testing tool called Artex alongside large language models to probe and exploit networks.
Financial Supervisory Service Governor Lee Chan-jin urged financial firms to strengthen their cybersecurity defenses during a meeting with board chairs from eight banking groups on October 28. The regulator has also announced security checks across dozens of private sector IT systems. South Korea’s presidential office convened an emergency meeting to coordinate defensive countermeasures following the string of concurrent incidents.
One report noted that financial authorities identified multiple North Korean IP addresses in attacks that began around October 21, marking the first time such addresses have been flagged in incidents targeting Korean financial firms, though no breach was directly traced to those addresses.
Regulatory and Legislative Challenges
Critics have pointed to the stalled Digital Finance Safety Act as a factor that has left the sector more vulnerable. The legislation would expand the authority of chief information security officers and elevate the Financial Security Institute into a statutory body. Security experts argue that governance in the financial sector remains outdated even as AI-automated attacks spread from banks and insurers to securities firms, asset managers and cryptocurrency exchanges.
During a national audit in mid-October, heads of South Korea’s five major banks apologized for earlier breaches and pledged to expand security budgets and staffing while building AI-based defense systems. Lawmakers criticized the time taken to detect intrusions and the scale of data exposed, noting risks that leaked information could fuel voice phishing and illegal private lending schemes.
Broader Regional and Technological Concerns
The incidents occur against a backdrop of growing cybersecurity challenges across Asia, where a series of breaches has heightened worries that artificial intelligence tools are lowering barriers to large-scale hacking. Similar to the approach Southeast Asia’s Toxic Haze Spurs Calls for Legal Action Against Polluters covered in related reporting on regional threats, authorities in Seoul are pressing for coordinated responses and stronger industry standards.
Finance, which handles money directly, remains the top target for hackers, yet many firms continue to rely on patchwork defenses for peripheral systems such as mobile work tools and account-opening portals. No direct financial losses from account takeovers have been reported in the recent waves, but officials warn that stolen personal data carries ongoing risks for customers.
Investigations into the latest breaches are ongoing, with affected companies cooperating with authorities and notifying impacted customers. Daishin Securities has committed to compensating any losses as required by law. The Financial Services Commission has intensified oversight of both digital and traditional banking infrastructure.
Scale and Potential Next Steps
The cumulative impact spans traditional banks, brokerages, asset managers and crypto platforms, underscoring vulnerabilities that extend beyond core banking systems. Previous incidents prompted police to consider referring cases to the Serious Crimes Investigation Agency over potential violations of financial security laws. Regulators continue to emphasize the need for a national “AI defense ecosystem” to counter automated threats.
Industry observers note that while South Korean banks spent substantial sums on cybersecurity in prior years, the attacks succeeded by targeting less-scrutinized peripheral systems. The pattern has renewed calls for legislation that would mandate higher security standards and faster incident reporting across the financial sector.
As probes continue and additional firms assess their systems, the events highlight the evolving threat landscape where AI tools accelerate both attacks and the need for defensive innovation. Financial authorities have not yet identified a single perpetrator linking all incidents, but the repeated targeting of the sector signals sustained pressure on South Korea’s digital financial infrastructure.
