Mirae Asset Securities breach: account numbers for about 3,800 customers leaked, and personal data on 35,255 current and former staff
Mirae Asset Securities confirmed on November 7, 2026 that external attacks on its mobile login service and internal groupware on November 4 and 5 leaked account numbers for about 3,800 customers and personal data on 35,255 current and former employees and contractors, including names and employee numbers and, for some, email addresses, mobile numbers and encrypted passwords.
What happened
Mirae Asset Securities, one of South Korea’s largest brokerages, announced on November 7, 2026 that external attacks on two of its systems earlier in the week had leaked customer and staff information. The first attack, on November 4, targeted the mobile web login service that authenticates customers by phone; the second, on November 5, targeted the company’s internal groupware system, called mi-global. The company says it detected abnormal access from external IP addresses, blocked the affected access routes at once and activated its emergency response system, and that it reported the incident to the Financial Services Commission, the Financial Supervisory Service and the Personal Information Protection Commission. On the company’s account, an outside party viewed internal data without proper authorisation; there was no malware infection and no system failure or service disruption, and its website and other major services are operating normally. The company says it is still investigating the cause of the incident and the path the leak took.
Who is affected
Two groups, with different data involved. About 3,800 customers who had opened accounts with the brokerage had their account numbers leaked. The company has confirmed that account holders’ names and other sensitive customer information were not leaked alongside the account numbers. The larger group is staff: personal information on 35,255 people — current and former employees, retirees and outsourced workers — was leaked. For staff, the information mostly consisted of names and employee ID numbers; for some individuals it also included email addresses, mobile phone numbers and encrypted passwords. The company says unique identification and sensitive data were not leaked for either group: no resident registration numbers, passport numbers, driver’s licence numbers or foreigner registration numbers were involved. Together the two groups total about 39,000 people. Aju Press counts this as the fourth Mirae Asset Group subsidiary targeted in under two weeks, after the Mirae Asset Life Insurance leak disclosed on October 26 — covered in our earlier report — and reported intrusion attempts at two group asset-management companies on October 28 and November 2; whether the attacks are connected has not been stated.
How serious
For customers, the direct risk is limited but real: an account number on its own, without the holder’s name, is not enough by itself to empty an account, but it is exactly the kind of true detail that makes a phishing or smishing message impersonating the brokerage believable. Mirae Asset Securities has itself warned of possible secondary damage and advised customers to watch for phishing and smishing attempts through phone calls, text messages and emails impersonating the company. For current and former staff, the exposure is broader: names, employee numbers and, for some, email addresses and mobile numbers give attackers what they need for targeted phishing against people with a known connection to the firm, and the encrypted passwords taken for some staff are a credential risk if they are cracked and the same passwords were reused on other accounts. The company says no financial damage has been confirmed to date.
What to do now
If you are a Mirae Asset Securities customer, treat any call, text or email claiming to come from the company as unverified: do not use a phone number, link or reply address supplied inside the message, and reach the company only through its official app, website or a number you source yourself. Watch your account activity and report anything unfamiliar to the company promptly. The company announced a temporary consultation centre for affected customers, operating from 10 a.m. to 5 p.m. on November 7. If you are a current or former employee, retiree or contractor in the staff group, change any password that reuses your groupware password anywhere else, and be alert for messages that use your real name, employee number or work details to sound official — those details are now in attackers’ hands, so their presence in a message is no longer proof the message is genuine.
Sources: Aju Press, “Mirae Asset Securities Customer Account Numbers Leaked; Employee Data Also Compromised,” November 7, 2026 · Seoul Economic Daily, “Mirae Asset Securities Hit by Hacking, Some Client and Staff Data Leaked,” November 7, 2026