[COVER STORY] Bithumb, Mirae Asset, Daishin join growing list of cyberattack victims

Brokerage firm Daishin Securities, cryptocurrency exchange Bithumb and asset manager Mirae Asset Global Investments have become the latest victims of cyberattacks sweeping the country’s financial sector, putting firms and regulators on heightened alert.

The suspected artificial intelligence (AI)-assisted attacks, first reported in the banking sector late last month, have spread across the financial sector, fueling customer concerns about financial firms’ ability to detect and respond to attacks.

While financial authorities are investigating how the recent breaches occurred and who was responsible, large-scale scanning attempts targeting financial systems from North Korean internet protocol (IP) address ranges have been confirmed for the first time. Authorities, however, cautioned against linking the recent attacks to North Korea.

“IP addresses alone cannot establish an attacker’s nationality or affiliation because address information can be manipulated and traffic routed through other locations,” an official at the Financial Security Institute (FSI) said.

Daishin said on Wednesday that personal and credit information belonging to 38,490 customers had been compromised.

The brokerage first detected suspicious access to a server supporting online securities account openings for discretionary investment services on Oct. 17. It blocked the attackers’ IP addresses, reported the incident to regulators and began investigating with the FSI.

A review of more than 60,000 signals disguised as legitimate service requests confirmed the data leak. The compromised information included customer names, email addresses, home addresses, login IDs, bank names, deposit and withdrawal account numbers, Daishin account numbers and mobile phone numbers. The account numbers and mobile phone numbers were encrypted, the company said.

Daishin said it had found no signs that the leaked information had been misused or that its core business systems had been compromised, adding that it will inform affected customers and compensate any who experience losses as a result of the breach.

Bithumb also suffered a breach, according to an official at the Financial Supervisory Service (FSS) on Wednesday. The company said it discovered on Tuesday that personal information had been leaked following unauthorized access to its internal mobile groupware system. The information known to have been compromised so far concerns employees, but the exchange is investigating whether customer data was also exposed.

Mirae Asset Global Investments also said Wednesday that it activated its emergency response procedures and blocked access routes after detecting suspicious activity from external IP addresses on some web systems.

The asset manager said no unique identification data, sensitive information or personal credit information had been found to be compromised. The affected systems do not serve individual customers, so investor information was not affected, it added.

The latest disclosures followed a breach at Mirae Asset Life Insurance, which detected unusual activity in some systems Sunday and initiated an emergency response. It was the first insurer confirmed to have been affected in the most recent wave of attacks.

Authorities have not ruled out the possibility of attacks on other firms, as investigations continue into how the attackers gained access and what information was compromised.

FSS Gov. Lee Chan-jin called for stronger information technology (IT) security at a meeting with the board chairs of eight banking groups on the day.

“As AI is used as a hacking tool, security vulnerabilities will become easier to identify and simultaneous attacks will become routine,” Lee said. “Boards should take the lead in strengthening IT security capabilities, recognizing that IT security is a core responsibility for protecting customers’ assets and information and maintaining trust in the financial system.”

Separately, regulators warned financial companies on Oct. 21 after detecting more than 4.4 million scanning attempts starting at 3 a.m. that day, with most identified IP address ranges classified as North Korean.

Scanning checks systems for open network ports and vulnerabilities that could allow unauthorized access. It can precede an intrusion but does not by itself mean a system has been breached.

The FSS similarly warned in an Oct. 6 notice that “some IP addresses cannot be linked to a specific country,” adding that even identifiable locations may reflect indirect routing.

Attacks spread, companies fail at early detection

Nearly a month after a breach at Shinhan Bank was reported to authorities on Sept. 30, cyberattacks have been confirmed across most major financial segments.

On Oct. 14, the Financial Services Commission and the FSS reported breaches at 16 companies and institutions, involving about 100,000 records containing customer information.

The affected firms included four banks — Shinhan, KB Kookmin, BNK Busan and Hana — and four savings banks — Yegaram, Welcome, DB and OK. Hyundai Capital and KDB Capital were among the affected credit finance companies.

Others on the list included peer-to-peer lenders PFCT and Mouda; electronic financial services provider Brightfix; cryptocurrency businesses Streami and Pravang; and the Korean Federation of Community Credit Cooperatives.

The disclosures by Daishin, Bithumb, Mirae Asset Global Investments and Mirae Asset Life Insurance bring the publicly identified total to 20.

More worryingly, additional leaks uncovered during follow-up reviews have raised doubts about the accuracy of financial firms’ initial findings and their ability to respond to breaches.

KB Kookmin Bank said Monday that it found information belonging to another 2,091 people had been exposed after detailed review with the FSS, taking the total from 119 to 2,210, about 18.6 times the initially reported figure. The newly identified cases involved 1,631 customers and 460 employees.

Lawmakers also questioned KB Kookmin’s and Shinhan’s initial responses during an Oct. 19 National Assembly audit.

KB Kookmin was first attacked at 11:19 p.m. on Sept. 27, but classified the activity as routine abnormal traffic and responded only by blocking the IP address. It subsequently faced further attacks.

Shinhan took about 15 hours and 26 minutes to detect an attack that began at 6:04 p.m. on Sept. 28, identifying it at 9:30 a.m. the next day. Further attacks followed, resulting in the leak of 25,727 records containing customers’ personal information.