Breach · 4 min read
Mirae Asset Securities: about 3,800 customer account numbers and 35,255 staff records leaked
Two attacks hit the Korean brokerage: about 3,800 customer account numbers on November 4, and records of 35,255 staff on November 5. Account passwords and trades were not taken.
Mirae Asset Securities, a major South Korean brokerage, said two separate attacks last week leaked some customer account numbers and personal information belonging to tens of thousands of current and former employees and contractors. The firm published customer and staff notices on November 7, 2026.
What happened
The company’s customer notice (in Korean), dated November 7, says there was abnormal external access on November 4 to the phone-authentication login service on its mobile web site. That access leaked personal information of about 3,800 customers. The leaked customer information is limited to account numbers opened at the firm. Account passwords, transaction history and other details, including the account holder’s name, were not leaked, the notice says.
The firm says it stopped that login service as soon as it learned of the leak, and that the service remains disconnected from the outside while it inspects the weakness and works out how to stop this happening again.
A second notice to employees (in Korean), also dated November 7, describes an external attack on November 5 against the company’s groupware system, called mi-global. That attack leaked personal information of about 35,255 employees, including retirees and contract staff. Most of those records were names and employee ID numbers. Some also included email addresses, mobile numbers and encrypted passwords. The exact items vary by person, the notice says.
Yonhap News Agency reported on November 7 that the firm reported the incident to the Financial Services Commission, the Financial Supervisory Service and the Personal Information Protection Commission. Yonhap also placed the brokerage’s leak in a wider run of Korean financial-sector incidents: the regulator, it said, has counted more than 470,000 personal data records leaked from 37 companies over the past month, with stolen funds estimated at 1 billion won (about US$745,000). Mirae Asset Life Insurance and other sister companies had similar leaks in the days before this one, Yonhap reported. Those are separate incidents from the two attacks described in the securities firm’s own notices.
What this means for you
If you are a customer whose account number was reached, someone who has that number still does not have your account password or a list of your trades, according to the company. They do have a detail that can make a phone call or text sound genuine. The customer notice warns people not to tap links or give out passwords, one-time codes or SMS codes, even if the other party already knows an account number.
If you are a current or former employee or contractor, a name and employee ID (and, for some people, an email address, mobile number or password) can be used to impersonate HR or IT, or to try the same password on other accounts.
What you can do
- Customers: change your cyber ID password on the official Mirae Asset Securities website, by typing the address yourself, and review recent orders, trades and transfers in the MAPS app, as the customer notice asks.
- Do not confirm a password, OTP or SMS code with anyone who contacts you about this leak, even if they recite your account number.
- If you see a trade you did not make, or you already gave a code to someone who called, contact the customer centre at 1588-6800. The temporary desk listed in the notice ran on November 7 and 8. From November 9 the firm asked people to use the regular centre on weekdays from 8:00 a.m. to 6:00 p.m. local time.
- Staff and contractors: treat unexpected messages that use your name or employee number as suspect, and change any password you reused if your notice included an encrypted password.
- See how scammers use leaked data to make a message feel personal if a call or text seems to know your account number.
How Frame helps
Add this breach to a verified email in Frame and Frame shows what it exposed, gives you a short checklist and counts it in your exposure report. Frame can also look up your verified emails in Have I Been Pwned’s breach database. Frame’s email aliases also let you give each service its own address, so a fake brokerage message that arrives at the wrong one stands out. Frame never collects or stores the leaked records themselves.
Related coverage
- Hyundai Ezwel, a Korean workplace benefits platform, says member details leaked through an API: another recent Korean disclosure involving names and contact details held by a large employer-facing service.
- How scammers use leaked data to make phishing personal: why an account number or an employee ID makes a fake call harder to dismiss.
Sources
- Mirae Asset Securities, Apology for the leak of customer personal (credit) information (in Korean), November 7, 2026
- Mirae Asset Securities, Apology for the leak of employee personal information (in Korean), November 7, 2026
- Yonhap News Agency, Personal info of some 39,000 leaked from Mirae Asset Securities, November 7, 2026
More stories
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.