South Korean financial services company Mirae Asset Securities has confirmed a data breach affecting approximately 3,800 customers and 35,255 current and former workers, according to reports from Yonhap News Agency, Chosun Ilbo and Asian Banking & Finance.
The company disclosed the incident on November 7, 2026, following unauthorized access to its systems on November 4-5.
- Mirae Asset Securities confirmed a cybersecurity incident on November 7, 2026, affecting approximately 39,000 customers and personnel.
- The breach exposed account numbers belonging to around 3,800 customers and personal details of 35,255 current and former employees, retirees and outsourced workers.
- Employee records included names, contact information, staff identification numbers and encrypted passwords. No financial losses had been confirmed.
The exposed information differed between customers and employees, with personnel records accounting for most of the affected individuals. No financial damage had been confirmed at the time of reporting.
What information was exposed in the Mirae Asset Securities breach?
The breach affected two groups, with different categories of information compromised. For approximately 3,800 customers, reports identified account numbers as the exposed information.
There was no confirmation that customer names, account passwords or balance information were accessed.
The larger exposure involved 35,255 people associated with Mirae Asset Securities, including current employees, former employees, retirees and outsourced workers.
According to the reports, the compromised personnel information included:
- Names
- Employee identification numbers
- Email addresses
- Mobile phone numbers
- Encrypted passwords
The inclusion of former employees, retirees and contractors means the incident affected individuals beyond the company’s active workforce.
Reports did not establish whether the encrypted passwords could be decrypted or otherwise misused.
Sensitive identification numbers reportedly remained secure
The reported breach did not involve several categories of government-issued identification information.
According to the available reports, the exposed records did not include:
- Resident registration numbers
- Passport numbers
- Driver’s license numbers
- Foreigner registration numbers
These identifiers can be particularly sensitive because they are used in identity verification processes. Their reported exclusion limits the categories of personal information confirmed as exposed, although employee contact details and encrypted credentials were still compromised.
Unauthorized access occurred on November 4-5
Mirae Asset Securities said the unauthorized access occurred on Wednesday and Thursday, November 4-5, 2026. The company confirmed the breach on November 7.
Available reports did not establish the method used to gain access or identify the attackers. The disclosed figures indicate that approximately 39,000 people were affected, with personnel accounting for the majority of exposed records.
No financial losses had been confirmed when the incident was reported. The available information does not establish whether the exposed data was subsequently misused.
According to the Financial Services Commission, more than 470,000 personal data records have been leaked from 37 companies across the financial sector over the past month, with the amount of funds stolen estimated at 1 bn won ($745K).
Since Sept. 30, when the first data leak was detected, a total of 40 data leak incidents have been reported at 37 companies, including four commercial banks, five financial investment firms, three insurance firms and five savings banks, according to the regulator.
