Bithumb, Daishin, Mirae Asset Breaches: What to Do

What happened

Three South Korean financial firms reported data breaches on Wednesday, Oct 28, 2026, according to Yonhap News Agency as relayed by ETCISO (Reuters).

Bithumb (crypto exchange): It said its in-house mobile system had been hacked and personal information leaked, and it was investigating whether member data was included, per ETCISO (Reuters). TechCrunch reports that neither Bithumb nor Mirae Asset has confirmed that customer data was taken. Whether member data was exposed is not confirmed.
Daishin Securities (brokerage): It said about 38,000 pieces of customer information had leaked and that it took emergency measures, per ETCISO (Reuters). TechCrunch gives the figure as 38,490 customers, with names, email addresses and mobile phone numbers exposed. Daishin has notified affected customers, is cooperating with authorities and says it will compensate for losses as required by law.
Mirae Asset Global Investments (asset manager): It confirmed a hacking incident and authorities were assessing the situation, per ETCISO (Reuters). The data affected is not confirmed.

Context from the sources:

The incidents follow a wave of attacks on 16 South Korean financial firms, including banks, causing around 100,000 cases of data leaks so far, according to the Financial Services Commission (FSC) earlier this month, per ETCISO (Reuters).
TechCrunch says security researchers linked the September wave to a suspected China-based hacker who used an AI penetration testing tool called Artex. Officials are still investigating the root cause of the latest breaches, so a link to that actor is not confirmed.
Separately, Seoul’s Science Ministry and the Korea Internet & Security Agency urged website operators to check for PHP flaws that let attackers run malicious commands on a server without logging in, per ETCISO (Reuters). The sources do not tie this to the three incidents, and no CVE is named.
South Korea’s financial regulator called for stronger cybersecurity measures and plans security checks on dozens of private-sector IT systems, per TechCrunch. TechCrunch also notes a Japanese incident involving GMO Internet, but investigators have not established a connection.

You may be affected if you are a customer or member of Bithumb, Daishin Securities or Mirae Asset Global Investments. Daishin customers are the most clearly affected, with names, emails and mobile numbers reported exposed.
Bithumb and Mirae Asset customers: exposure of your data is not confirmed, but both firms reported hacking incidents.
If you run public websites, especially in South Korea, the Science Ministry and KISA advice to check for PHP flaws applies to you. No link to these breaches is confirmed.
Affected versions, CVEs and patches: not confirmed in the sources.

Watch for notices from Daishin, Bithumb or Mirae Asset and read them carefully. Daishin says it has notified affected customers.
Change your passwords for these services, and for any other account that reuses them. Turn on multi-factor authentication where offered.
Treat unexpected emails, texts and calls that reference your name, email address or mobile number as possible phishing, especially if they claim to come from a financial firm. Do not follow links in them.
Review account activity and statements for unfamiliar transactions. Contact the firm through its official channels if you see any.
If you operate PHP-based websites, check them for the unauthenticated command execution flaws flagged by Seoul’s Science Ministry and KISA, and apply vendor patches. The specific flaws are not named in the sources.
Security teams at financial firms should expect regulator scrutiny, as the FSC plans security checks on dozens of private-sector IT systems.
Follow updates, since the root cause of these incidents is still under investigation.