Government launches emergency response as breaches spread from banks to securities firms, asset managers and crypto platforms

As hacking incidents spread from the banking sector to the financial investment industry, the government has launched an emergency response. Following a series of security breaches at securities firms, asset management companies and virtual asset exchanges, along with confirmed leaks of customer information, the Cheong Wa Dae National Security Office, financial regulators and police have begun assessing the damage and preventing further spread, marking the start of a full-scale government-wide response.

According to the financial investment industry on the 28th, personal and credit information belonging to 38,490 customers was leaked from Daishin Securities. Daishin Securities detected signs of abnormal external access on its non-face-to-face securities account opening linked server on the 17th, and confirmed the leak of customer information on the 26th after an investigation conducted jointly with the Financial Security Institute.

The leaked information includes eight items: customer names, email addresses, residential addresses, communication IDs, bank names, deposit/withdrawal account numbers, Daishin Securities comprehensive account numbers and mobile phone numbers. The two types of account numbers and mobile phone numbers were encrypted. Daishin Securities stated that no illegal access to core business systems or signs of secondary damage have been confirmed so far.

At Mirae Asset Global Investments, information related to general business systems was leaked due to abnormal access from external IP (Internet Protocol) addresses to some web systems. The company has blocked the access route and is investigating the cause and scope of impact with an external security specialist agency. No signs of direct intrusion into servers or databases have been confirmed so far, and there are no indications that unique identification information, sensitive information or personal credit information was leaked.

At virtual asset exchange Upbit, it was confirmed that employee information from Upbit, its subsidiaries and partner companies was leaked due to access by an unauthorized external party. The possibility of user information leakage is under investigation, and there has been no confirmation yet of leaks involving information such as virtual asset wallet addresses that could be used for fraudulent payments or virtual asset transfers.

The Cheong Wa Dae National Security Office held an "Emergency Review Meeting on Response to Chain Hacking in the Financial Sector" chaired by Deputy Director Song Ki-ho on the day, reviewing response status by relevant agency. The meeting was convened to oversee and coordinate responses to security incidents in the financial sector—including banking, securities, insurance and online peer-to-peer lending—and the virtual asset field. Officials from the Financial Services Commission, Ministry of Science and ICT, Personal Information Protection Commission, Financial Security Institute and Korea Internet & Security Agency attended.

At the meeting, participants reviewed investigation and action status for each incident and discussed measures to prevent secondary damage such as smishing and voice phishing that exploit leaked information. They also examined plans to inspect similar attack routes, including external linked servers and internal business systems. Attending institutional investors agreed to share attack information and investigation results in real time and cooperate going forward.

Deputy Director Song said, "Hacking in the financial sector directly affects citizens' property and trust in finance, so please ensure swift response and all-out efforts to block secondary damage," adding, "Please make every effort to strengthen security so that entities with limited security capacity, such as small and medium-sized financial companies, do not become blind spots."

The National Security Office plans to continuously monitor the action status of relevant agencies and consider additional measures if necessary. It also urged citizens to be cautious of phone calls and text messages impersonating financial institutions.

The Financial Services Commission also held an emergency review meeting on the day, chaired by Digital Finance Policy Officer Yoo Young-jun, with participation from the Financial Supervisory Service, Financial Security Institute, Joint Consultative Body for Digital Asset Exchanges (DAXA) and Upbit. The authorities have begun on-site inspections and decided to identify the cause of the incidents through information sharing and cooperation among relevant agencies.

The Financial Services Commission stated, "We plan to thoroughly inspect to ensure no consumer damage occurs," adding, "In cases where damage has occurred, we will manage and supervise to ensure consumer protection measures such as full compensation are implemented."

It also decided to push forward plans to strengthen security measures in sectors not currently covered by the Electronic Financial Transactions Act, such as the virtual asset industry, to the level of major financial companies like banks, and to establish a rapid response system for when incidents occur.

Police also began a preliminary investigation (pre-case-filing inquiry) into the hacking incident on the day. The National Police Agency's National Investigation Headquarters plans to examine the attack method of this incident and its connection to existing cases through the investigation team that had been handling the chain hacking case in the financial sector.

A common point emerged in these incidents: external linked servers and general business support systems were targeted rather than core financial transaction systems. Security breaches were confirmed at Daishin Securities' non-face-to-face account opening linked server, some web systems at Mirae Asset Global Investments, and Upbit's internal mobile groupware.

The nature of the damage differs by company. At Daishin Securities, customers' personal and credit information was actually leaked, while at Mirae Asset Global Investments, general business-related information was found to be leaked. At Upbit, signs of employee information leakage were confirmed, but it is under investigation whether user information was included.

Even if core trading systems are not breached, leaked personal information can lead to secondary damage such as impersonation of financial companies or smishing and voice phishing. This is why the National Security Office emphasized inspections of external linked servers and internal business systems, as well as prevention of financial fraud exploiting leaked information.

Lee Chan-jin, Governor of the Financial Supervisory Service, also diagnosed at a meeting with the chairs of the boards of directors of eight major bank holding companies on the day that "amid daily sophistication in cyber attack methods, attacks are showing an all-around trend, expanding to non-core facilities." The Governor warned of the possibility that security vulnerability detection and simultaneous attacks could become constant as AI (artificial intelligence) is utilized as a hacking tool, and urged financial companies to build autonomous defense systems that proactively find and eliminate vulnerabilities.