Bithumb employee system breached amid wider financial cyberattacks

South Korean cryptocurrency exchange Bithumb has confirmed a cyberattack on its internal employee communications system, exposing personal information and prompting an investigation into whether customer data was compromised.

The exchange discovered unauthorised access to its mobile groupware system on Tuesday and disclosed the incident on Wednesday, as financial regulators examined separate security breaches at brokerage Daishin Securities and asset manager Mirae Asset Global Investments.

Bithumb said the compromised system operates independently of its cryptocurrency trading infrastructure, meaning the intrusion did not provide direct access to customers’ digital assets. The company has not identified any theft of cryptocurrency linked to the incident.

Preliminary findings indicate that the exposed information primarily concerns employees. However, Bithumb is examining whether customer details stored or exchanged through internal communications were also accessible to the attackers.

The exchange notified the Korea Internet and Security Agency and the Personal Information Protection Commission on the day it discovered the breach. Investigators are examining the intrusion method, the categories of information exposed and the number of individuals potentially affected.

Bithumb has informed employees about the incident and is assessing whether additional notifications or protective measures will be necessary if customer information is confirmed to have been compromised.

The attack involved an internal mobile collaboration platform used for workplace communications and administrative functions. Such systems can contain documents, contact information and operational correspondence, making them potential targets even when separated from financial transaction networks.

The identity of the attackers and the precise method used to penetrate the system remain undetermined. Bithumb has not disclosed a confirmed figure for affected individuals or specified the full range of information obtained.

The disclosure coincided with confirmation by Daishin Securities that hackers accessed personal and financial information belonging to 38,490 customers.

Daishin identified suspicious access on 17 October involving a server connected to online securities account opening services. The compromised information included customer names, email addresses, telephone numbers and other account-related details.

The brokerage said it had notified affected customers and was cooperating with authorities investigating the intrusion. It also pledged compensation for losses arising from the breach in accordance with applicable laws.

Daishin has not identified evidence of secondary financial damage associated with the exposed information. Nevertheless, the disclosure has raised concerns about possible misuse of personal details for impersonation, fraudulent communications or attempts to access financial accounts.

Mirae Asset Global Investments separately confirmed that unauthorised external access had been detected within parts of its web infrastructure.

The asset manager said it blocked the affected access routes and activated emergency security procedures. Its preliminary assessment indicated that exposed information was confined to certain internal administrative systems.

Mirae Asset stated that sensitive personal information, credit records and investor information had not been compromised. Financial authorities are examining the circumstances of the incident and assessing the company’s response.

The three disclosures add to a series of cyber incidents affecting South Korea’s financial services industry, including banks, securities businesses, asset managers and insurers.

Financial Supervisory Service Governor Lee Chan-jin said cyberattacks had affected 16 financial institutions by 14 October, highlighting the extent of the security challenges confronting the sector.

The supervisory authorities have intensified scrutiny of financial institutions’ information technology systems, including their ability to identify unauthorised access, contain intrusions and safeguard confidential customer records.

Mirae Asset Life Insurance also identified suspicious system activity on Sunday and initiated emergency measures after confirming an intrusion, extending the security concerns to the insurance industry.

The attacks have drawn attention to vulnerabilities outside core banking and trading infrastructure, particularly employee applications, administrative servers and internet-facing business systems.

South Korea’s Ministry of Science and ICT and the Korea Internet and Security Agency have urged website operators to inspect systems for vulnerabilities involving PHP, a programming language widely used in web applications.

Security authorities have warned that weaknesses in internet-accessible software can create opportunities for attackers to obtain unauthorised access to organisational systems.

Whether the disclosed breaches share a common perpetrator or technical method has not been established. Investigations into the individual incidents are continuing, and the companies have not identified a coordinated operation.

Bithumb’s investigation is also examining material exchanged through its employee platform to establish whether customer records appeared in internal files or correspondence.

The exchange maintains that the affected workplace system is isolated from its trading network. Its assessment of the information exposed remains incomplete, with the number of affected employees and any additional customer notifications still to be determined.