The Daishin Securities breach exposed the names, email addresses and mobile numbers of 38,490 customers, according to local Korean media cited by TechCrunch. Mirae Asset Global Investments and crypto exchange Bithumb reported separate incidents. For Cyprus brokers and CASPs, those three fields are all a believable phishing call needs.
Key takeaways
- Daishin Securities confirmed that names, emails and mobile numbers for 38,490 customers were exposed.
- Mirae Asset and Bithumb reported separate incidents. Neither has confirmed customer-data theft.
- No entry point or attacker has been named, and nothing ties these cases to Artex or GMO Internet.
- Contact data alone enables smishing and helpdesk vishing, so test your support desk.
What did the Daishin Securities breach expose?
Daishin confirmed that personal data for 38,490 customers was exposed, limited to names, email addresses and mobile phone numbers. The firm has notified affected customers, is cooperating with investigators and says it will compensate losses as required by law, without giving an amount.
Mirae Asset Global Investments and Bithumb each reported a separate incident on Wednesday. Neither had confirmed that customer data was taken. Officials have not named an entry point, a vulnerability class or an attacker, and have not linked the three cases.
South Korea’s Financial Services Commission (FSC) has called for stronger cybersecurity, and Seoul plans checks on dozens of private-sector IT systems. None of the three firms, nor the FSC, answered TechCrunch.
Is contact data enough to hurt a broker's client book?
Yes. A name, a working email and a mobile number are the raw material for targeted smishing. A text about a frozen withdrawal or a pending KYC check, sent to someone who really trades with that broker, gets opened. A follow-up call from a fake compliance officer does the rest.
Staff are targets too. A support agent who resets MFA after a caller recites a client’s details hands over the account. An authorized social engineering assessment should include vishing against the helpdesk, not only an email campaign.
Is this the Artex campaign, and is GMO Internet linked?
Not on current evidence. Researchers suspect, but have not confirmed, that a China-based hacker using Artex, an AI penetration-testing tool, was behind a September wave against South Korean financial institutions. Nobody has tied it to the latest incidents (background in our report on the ARTEX AI data theft case in Seoul). Japan’s separate GMO Internet incident, covered in our Onamae Desktop Cloud analysis, has not been linked either.
Without a known entry point, hunt for outcomes, not signatures: bulk reads of customer tables, unusual exports, new OAuth grants, fresh MFA factors and outsized outbound transfers.
What should a Cyprus broker or CASP be able to prove now?
You should be able to show that you would detect an intrusion like this, report it on time and warn clients before the phishers do. No reporting clock waits for attribution.
DORA has applied since January 17, 2025, to EU investment firms and crypto-asset service providers and requires them to classify and report major ICT incidents. Where NIS2 applies, an early warning is due within 24 hours and a notification within 72. GDPR Article 33 runs its own 72-hour clock.
- Logs first. Preserve web, WAF, identity-provider, EDR, database-audit and cloud logs before remediation rotates them.
- Unconfirmed does not mean not taken. Check customer-table queries, backups, object storage and egress before closing the question.
- Client comms ready. Keep approved notification templates and require a callback before any helpdesk MFA reset.
- Tested, not documented. CySEC ICT risk and cybersecurity testing should cover support desks and data-export paths. Exchanges and custodians should add MiCA and CASP penetration testing.
FAQ
How many Daishin customers were affected?
38,490, with names, email addresses and mobile phone numbers exposed.
Have Mirae Asset or Bithumb confirmed that customer data was stolen?
No. Both reported separate incidents on Wednesday, but neither had confirmed data theft.
Was the latest wave attributed to the Artex AI tool?
No. Researchers suspect, without confirmation, that a China-based hacker using Artex was behind the September wave. Nobody has tied Artex to the latest incidents.
What has South Korea's financial regulator done?
The Financial Services Commission called for stronger cybersecurity, and Seoul plans security checks on dozens of private-sector IT systems.
If a peer’s disclosure left you unsure what your own logs and helpdesk would show, a NIS2 and DORA compliance readiness review will tell you before a regulator asks.