Mirae Asset Securities has disclosed two intrusions affecting different parts of its business: a customer login service and its internal groupware. The South Korean brokerage’s notices describe the exposure of account numbers belonging to about 3,800 customers and personal information associated with approximately 35,255 current and former workers and outsourced staff.
The distinction matters. This is not a disclosure that 39,000 customer accounts or customer passwords were compromised. The company published separate notices on November 7, following attacks on November 4 and 5.
Two systems, different information
In its customer notice, Mirae Asset Securities says abnormal external access to its mobile-web phone-authentication login service on November 4 exposed account numbers. Account-holder names, account passwords and transaction histories were outside the disclosed customer exposure.
The firm says it halted that service and blocked external connections while checking vulnerabilities and investigating how the incident happened.
A separate workforce notice identifies a November 5 attack on mi-global, the internal groupware system. Most exposed records contained names and employee numbers. Some also included email addresses, mobile numbers or encrypted passwords; the precise fields differ by individual.
The description of passwords as encrypted does not establish how they were protected. The notice does not name an encryption or password-storage method, and it should not be read as evidence that the credentials are unusable.
Mirae Asset Securities says it disconnected the affected server, blocked external access to groupware and related mobile services, and expanded checks to other externally accessible internal systems. Its notice promises a review of access controls and abnormal-activity detection.
Watch for convincing impersonation
Aju Press reported that the brokerage was the fourth Mirae Asset Group affiliate to disclose an intrusion in less than two weeks. That sequence alone does not establish a common attacker or a shared technical cause.
According to Yonhap, the company reported the incident to South Korea’s Financial Services Commission, Financial Supervisory Service and Personal Information Protection Commission. SBS reported the company’s statement that no financial loss had been identified at disclosure.
Customers are being urged to change their cyber-ID password through the official website and review recent orders, executions and money movements in the MAPS app. Anyone finding an unfamiliar transaction, or who has given authentication information to an impersonator, should report it immediately through the company’s official customer-service channel.
For workers, the company warns that a message containing a real name or employee number may still be fraudulent. It advises verifying work requests through an existing, known contact, and avoiding suspicious links, attachments and software-installation requests.
