Mirae Asset Securities Breach Exposes 3,800 Customer Account Numbers

Mirae Asset Securities, one of South Korea's three largest brokerages by equity capital, said on Nov. 7, 2026, that cyberattacks had exposed the account numbers of about 3,800 customers. The intruders targeted its mobile-web login service, which relies on mobile phone verification, and an internal system. The firm is the latest victim of a hacking wave that has hit Korean financial companies since Sept. 30, 2026.

The breach also exposed records on 35,255 current and former employees and contractors, the Financial News reported. Mirae Asset Securities is the fourth affiliate of Mirae Asset Group exposed to a hacking incident, after the group's life insurer and two of its asset managers, according to the Seoul Economic Daily.

Across the sector, 37 financial companies reported 40 hacking incidents between Sept. 30 and Nov. 3, 2026, the Financial Services Commission (FSC), Korea's financial regulator, said on Nov. 5. The incidents exposed about 473,000 records of personal information. That count ends before the Nov. 4 attack on Mirae Asset Securities.

What Was Exposed

For customers, the leak was limited to account numbers. The company said account holder names, passwords and balance records were not exposed, the Asia Business Daily reported.

Employee data went further. Names and employee ID numbers leaked for all 35,255 people, according to the Financial News. For a very small number of them, mobile phone numbers, email addresses and encrypted passwords leaked as well.

The company said no unique identifiers or sensitive personal data were exposed. That covers resident registration numbers, which are Korea's national ID numbers, as well as passport, driver's license and foreigner registration numbers.

A Mirae Asset Securities official said no financial losses to customers had been confirmed, according to the Asia Business Daily. The official added that the home trading system (HTS) and mobile trading system (MTS), the desktop and phone platforms customers use to trade, were running normally.

How the Breach Unfolded

The intrusions came on two consecutive days, according to a Yonhap News Agency report carried by the Korea JoongAng Daily. The company said unauthorized external access hit its mobile-web phone authentication login service on Nov. 4 and an internal system on Nov. 5. Korean outlets identified the internal system as the company's groupware, called mi-global.

Mirae Asset Securities said it blocked the access routes after spotting abnormal connections from external IP addresses, then activated its emergency response system. "This was a breach in which outsiders viewed system data without proper authorization," a company official said, according to the Asia Business Daily (translated from Korean). The official added that there had been no malware infection or disruption of computer services.

An official told Money Today that the firm completed security measures for the vulnerability as soon as it learned of the incident, without describing the flaw. None of the reports said which of the two systems the customer account numbers came from.

"We once again deeply apologize for failing to fulfill our responsibility to protect our customers' valuable personal (credit) information," co-CEOs Kim Mi-seop and Heo Seon-ho said in a notice, the Financial News reported (translated from Korean). They said they were closely examining the cause and how the data leaked, and were preparing measures to prevent a recurrence.

Inside Mirae Asset Group, the problems began at the life insurer. Mirae Asset Life Insurance confirmed a customer data leak early on Oct. 26, 2026, Money Today reported, and Yonhap reported a breach at Mirae Asset Global Investments on Oct. 28. Mirae Asset Energy Infrastructure Asset Management took its website offline after an intrusion attempt that it said leaked no customer data, Edaily reported on Nov. 2.

The Regulatory Response

Mirae Asset Securities said it reported the breach to the FSC, to the Financial Supervisory Service (FSS), which inspects financial firms, and to Korea's privacy regulator, the Personal Information Protection Commission (PIPC). It said it had also notified affected clients and employees individually within the legal deadline, the Seoul Economic Daily reported.

The FSS has already sent inspectors to two of the group's other companies. Its check of Mirae Asset Life Insurance, first scheduled to end on Oct. 30, has been extended once, the Financial News reported on Nov. 4. The paper said the check could become a formal examination if rule violations are found.

The FSS began an on-site inspection of Mirae Asset Global Investments on Nov. 2, scheduled to run through Nov. 5, according to Edaily. The Nov. 7 reports did not say whether the FSS would inspect Mirae Asset Securities.

The wider response was already under way. On Nov. 5, the FSC said regulators would inspect the websites and other external-facing systems of about 580 financial firms, finishing registered systems by Nov. 30, 2026. The remaining systems and a review of internal controls are due by Dec. 31, 2026.

Large financial companies will have to commission outside vulnerability assessments twice a year instead of once. FIRST, a joint anti-hacking monitoring system run by the FSS, will begin a pilot in December 2026, the FSC said.

So far, the attacks have mostly taken data rather than money. Attackers stole about ₩1 billion ($740,000), mostly from the management accounts of smaller virtual asset, electronic financial services and online peer-to-peer lending firms, the FSC said. No individual user had been found to have lost money.

Won amounts in this article are converted at ₩1,356.6 per dollar, the rate at 3:30 p.m. in Seoul on Nov. 6, 2026, reported by the Seoul Economic Daily.

"A financial company that cannot protect its customers' information and assets has already lost its reason to exist," FSC Chairman Lee Eog-weon told financial industry officials on Nov. 5, according to an FSC press release (translated from Korean).

The FSC also said that it and the FSS would supervise affected firms under the strict liability rule in the Electronic Financial Transactions Act. Strict liability means a company can be held responsible for a loss even when it was not at fault.

Korea context: Mirae Asset Securities has been sanctioned over a login flaw before. From Feb. 8, 2019, to March 19, 2021, an error in its emergency login program let users sign in with an ID alone, without a password. On March 19, 2021, customers who mistyped an ID were logged in as other customers and could see those customers' names and the value of their accounts and holdings, Newsis reported. The company knew right away but did not notify the affected customers until the day the FSS began its examination, according to Newsis. The FSS issued an institutional caution and a ₩121.6 million ($90,000) fine over that case and a trading outage on the same day, Newsis reported on Nov. 10, 2025.

What Customers Can Do

Regulators' main concern is follow-up fraud that uses leaked data. The FSC and the FSS issued a Level I "Caution" consumer alert on Oct. 6, 2026, over possible phishing attacks and loan scams. On Nov. 6, the FSC said the alert would stay at that level.

The FSC also extended its special response period for secondary damage from data leaks, first set to end on Nov. 5, through the end of December 2026. As of Nov. 6, no cases of customer money lost to voice phishing or smishing linked to the recent leaks had been reported, the FSC said.

Its advice is to avoid clicking web links in text messages from unknown senders, to hang up on suspicious calls and to check through the 1394 counseling line, which needs no area code.

Other basic steps apply to any Korean brokerage account. Customers can read notices in the broker's official app or website rather than through links in messages, and they can review recent account activity. Changing passwords is a simple precaution, even though Mirae said customer passwords were not exposed.

Mirae Asset Securities also serves investors outside Korea. It set up a Hong Kong subsidiary in 2007 and in June 2026 launched MAPS, an app that lets Hong Kong users trade Korean stocks, the Korea JoongAng Daily reported.

The Nov. 7 reports cited here described attacks on the Korean company's mobile website and groupware. None of them mentioned the overseas units, MAPS or customers outside Korea.

Foreign investors who hold accounts directly with Korean brokers can take the same steps as local customers. Our guide to buying Korean stocks from abroad explains the different ways foreigners reach the market.

Taken together, the Mirae Asset Securities leak exposed a narrow slice of customer data but extended a wave of attacks that now reaches four Mirae Asset Group affiliates. The next markers are the FSC's Nov. 30, 2026, deadline for inspecting external-facing systems at about 580 firms and the end of its special response period in December 2026.