On 28 October 2026, Daishin Securities disclosed that personal and credit information of 38,490 of its customers had leaked. The South Korean brokerage traced the leak to abnormal access to a server used for opening non-face-to-face accounts for discretionary investment services. The leaked set included email addresses, together with names, addresses, bank names and account identifiers. On the disclosure date, Daishin Securities said no secondary damage had been found so far and its core business system had not been accessed. Both statements were limited to what had been found by that date.
Detection, confirmation and disclosure
Abnormal access was first detected on 17 October 2026, according to Maeil Business Newspaper, reporting the company announcement. The affected server supported the opening of non-face-to-face securities accounts for discretionary investment services. Once the access was detected, the company blocked the IP addresses used, reported the incident to regulators, and worked with the Financial Security Institute to examine how far the leak reached. About 60,000 signals disguised as normal service requests were reviewed, and that review confirmed the leak on 26 October 2026. The company made the leak public two days later.
The Korea Times gives the same detection date, the same account opening server, the same Financial Security Institute investigation and the same review of more than 60,000 signals. Yonhap confirms the disclosure date and the customer count. No source read for this draft states an attack vector. None states a vulnerability, an attacker identity, or an attribution for the Daishin incident. This article therefore states only abnormal access and signals disguised as normal service requests, which is what the company announcement as reported describes. Reports of North Korean IP ranges elsewhere in the financial sector are not attached to Daishin in this article.
Customer data in the leaked set
As reported by Maeil Business Newspaper and Chosun Biz, the company announcement lists eight leaked items. They are customer name, email address, address, communication ID, bank name, deposit and withdrawal account number, Daishin Securities comprehensive account number, and mobile phone number. The company described three of them as encrypted: the deposit and withdrawal account number, the Daishin Securities comprehensive account number, and the mobile phone number. It did not describe the other five as encrypted. No source read for this draft states an encryption method or a key status for the three encrypted items, so this article makes no claim that the encrypted items are safe.
Yonhap's short wire report lists mobile phone numbers among the leaked sensitive information. It gives no encryption qualifier. The detailed reports quote the company as stating that mobile phone numbers were encrypted. This article treats the short report as an omission of detail, not a contradiction. It states the encryption claim as the company's statement. The limit on that claim comes from an outside expert: Soonchunhyang University professor Yeom Hong-yeol told Chosun Biz that an encryption key leak cannot be completely ruled out. He also said unencrypted general information could lead to voice phishing and pharming attacks. No password, payment card number or resident registration number exposure for Daishin is stated in any source read for this draft. None is claimed here.
Notification, compensation and system fixes
According to Maeil Business Newspaper and The Korea Times, Daishin Securities said each affected customer will be told individually which items leaked for that customer. The company also said customers who suffer damage from the leak will be compensated in accordance with law and procedure. Chief executive Jin Seung-wook apologised to customers and said the company takes the leak seriously.
Server access control and abnormality detection and blocking will be strengthened, the company said, and external connection systems will be checked for security vulnerabilities. Both dated 28 October 2026, the statements that no secondary damage had been found so far and that no unauthorised access to its core business system had been found cover only what had been found by that date. Individual notification wording, a notification date beyond the planned individual notice, and compensation procedure detail appear in no source read for this draft.
Separate disclosures on the same day
The two other firms disclosed incidents on 28 October 2026, but their scope is separate from Daishin's. What follows in this section is context only. It is not added to the Daishin count.
Bithumb, a cryptocurrency exchange, found on 27 October 2026 that unauthorised access to its internal mobile groupware system had leaked personal information, according to SBS. So far, employee information is known to have been compromised, and the company is investigating whether member information was involved. The sources read disclosed no victim count for Bithumb.
Mirae Asset Global Investments found abnormal access from an external IP address in some web systems, blocked the access route, and activated an emergency response, according to SBS and The Korea Times. The company said no unique identification information, sensitive information, or personal credit information had been found to be compromised. Investor information was not affected, it said, because the affected systems do not serve individual customers.
Financial accounts and email addresses
One email alias per service is what AliasFleet provides, so a leak from one service can only point back to that service. Ordinary signups, forums, shopping, and newsletters are where that mechanism applies. A brokerage account is different: it is a financial account. The canonical position in the guide to a separate email for banking applies in the same form here: the financial account holds a permanent real dedicated address used only for that account, never a masked or relay alias, because recovery, statements, and fraud alerts depend on that address. Aliases are for everything else, and that keeps the dedicated financial address out of unrelated databases. A dedicated address does not take back data that has already leaked. It does not change the exposure of names, addresses, or account identifiers in this incident.
Steps for affected customers
Published guidance on what to do when an email address is in a data breach describes checking whether the address appears in a known leak, changing any password reused across services, and treating unsolicited messages that quote real personal details with suspicion. Affected customers can check an address through Have I Been Pwned, once the incident is listed there. The phishing risk here is specific. A message that quotes a real name, address, bank name, or communication ID proves possession of the leaked file. It does not prove that the sender is Daishin Securities, and the guide to how phishing uses a leaked email describes that mechanism in full.
Daishin customers affected by this leak should also watch for messages combining several leaked items at once. An email address combined with a name, an address and a bank name makes a fraudulent message harder to dismiss at a glance. The company has said affected customers will be informed individually. A notice arriving outside that individual notification, or asking for credentials or payment, deserves the same suspicion as any other unsolicited message quoting leaked details.
Your address is probably in this file. Check whether it is, do the password work above, and then fix the part you control: the address you hand out next time. One AliasFleet alias per service means the next leak can only point back to the service that leaked it. Founders Club is $7 a month, locked forever, instead of $12. Early members only.
Regulator inspection and open questions
According to SBS, the Financial Supervisory Service is assessing the incident, including dispatching an on-site inspection team to Daishin Securities. How the access occurred, whether any other system was touched, and whether the leaked data is misused after 28 October 2026 remain open questions in the sources read. Those sources stated no further Daishin disclosure, no victim count revision, and no confirmed misuse.
Top comments (0)