---
title: "40 hacks at 37 Korean financial firms in five weeks; regulator to inspect 580"
summary: "What South Korea’s Financial Services Commission reported for 30 September to 3 November: 473,000 records, about ₩1 billion stolen, and the inspection of about 580 firms."
url: https://www.thetechbag.com/blog/korea-40-hacks-37-financial-firms
format: Analysis
desk: "Security"
area: "Threats & vulnerabilities"
region: Global
published: 2026-11-09
facts_checked: 2026-11-09
author: TechBag (The TechBag Journal)
tags: ["South Korea","Financial Services Commission","Financial Supervisory Service","Financial Security Institute","financial sector breaches","data breach","API security","test environments","third-party security evaluation","network separation","virtual asset service providers","P2P lending","Daishin Securities","Mirae Asset Securities","Bithumb","voice phishing","CERT-In","NBFC"]
cover: https://www.thetechbag.com/blog/covers/korea-40-hacks-37-financial-firms.png
---

# 40 hacks at 37 Korean financial firms in five weeks; regulator to inspect 580

*What South Korea’s Financial Services Commission reported for 30 September to 3 November: 473,000 records, about ₩1 billion stolen, and the inspection of about 580 firms.*

Analysis · Security · Threats & vulnerabilities · By TechBag · Published 2026-11-09 · Facts checked 2026-11-09 · Canonical: https://www.thetechbag.com/blog/korea-40-hacks-37-financial-firms

The short version

1. South Korea’s Financial Services Commission counted 40 hacks at 37 financial firms between 30 September and 3 November, with about 473,000 personal records taken. On 14 October the count stood at 16 firms.[1][2]
2. The data was mainly employee information or customers’ names, resident registration numbers and account numbers. No account passwords have been confirmed leaked. About ₩1 billion was stolen, mostly from accounts where firms pool customer money, and the regulator says no individual user has lost funds so far.[3]
3. The FSC will inspect the internet-facing systems of about 580 firms by 31 December and double large firms’ outside security evaluations to two a year. It has not said whether AI was used in any of the 40, or whether they are connected.[1][2]

Thirty-seven financial companies in South Korea, from four banks to three crypto firms, reported 40 hacking incidents in the five weeks from 30 September to 3 November, the Financial Services Commission (FSC) said on 5 November.[1] Two days later Mirae Asset Securities, which the Korea Herald calls the country’s leading brokerage, reported a further breach.[6] The question for a financial firm anywhere is practical: which systems did the intruders come through, what did they actually take, and what is the regulator now demanding?

## Sixteen firms on 14 October, 37 by 3 November

On 14 October the FSC counted 16 companies and about 100,000 pieces of customer data.[2] By the cut-off for its 5 November meeting the count stood at 37 companies and 40 incidents.[1] The Korean release says who the later reports came from: since the sector-wide checklist finished on 14 October, breaches have mainly been reported by small and mid-sized securities firms and insurers, electronic-finance companies, peer-to-peer lenders and crypto exchanges.[3]

**Figure: The count went from 16 firms to 37 in 20 days, and a new breach came after the cut-off**

*Regulator counts and company disclosures in South Korea's financial sector, 30 September to 7 November 2026*

| Date | Event | Detail |
| --- | --- | --- |
| 30 Sept 2026 | The FSC's count begins | The date from which the FSC counts breaches as confirmed |
| 6 Oct 2026 | Consumer alert, Level I | Caution on phishing; a one-month special response period starts |
| 14 Oct 2026 | 16 firms, about 100,000 records | Customer data; 555 firms finish a 12-point checklist |
| 17 Oct 2026 | Daishin detects access | A server linked to remote account opening; 38,490 customers' data confirmed on 28 October |
| 28 Oct 2026 | Brokers, a fund firm, an exchange | Daishin Securities, Mirae Asset Global Investments and Bithumb disclose breaches |
| 3 Nov 2026 | 37 firms, 40 hacks, 473,000 records | The cut-off of the FSC's count |
| 5 Nov 2026 | Plan to inspect about 580 firms | On 6 November the special response period is extended to the end of December |
| 7 Nov 2026 | Mirae Asset Securities: about 39,000 | Access on 4 and 5 November, after the FSC's cut-off |

Source: FSC releases of 6 and 14 October and 5 and 6 November 2026; company statements as reported by HuffPost Korea and The Korea Herald · as of 9 November 2026

TechBag countTechBag count: what compares and what does not

The firms compare: 21 more in the 20 days from 14 October to 3 November. The records do not. The 100,000 was customer data; the 473,000 is personal information that includes employees’, so it is not a like-for-like rise of nearly five times. Forty incidents at 37 firms means at least one firm reported more than once. The five weeks are 35 days, counting both end dates.

The count is already behind events. Mirae Asset Securities says outsiders got in on 4 and 5 November, after the FSC’s cut-off.[6] On 6 November the FSC extended its special response period, due to end on 5 November, to the end of December, saying more leaks were still being confirmed.[4]

## Every part of finance reported one; electronic-finance firms the most

The FSC’s list runs across nine sectors. Electronic-finance companies are the largest group at ten; banks number four.[1] A hint of this came on 14 October. All 555 firms had filled in a 12-point self-assessment; 425 rated themselves “appropriate” and 130 reported something to fix, mostly security patches or control systems. Those gaps appeared more in electronic finance and peer-to-peer lending, which the FSC said “tend to have relatively lower cybersecurity capacity”.[2] The FSC has not said how many of the 425 that rated themselves appropriate were later breached.

**Figure: Electronic-finance firms were the largest group; non-traditional finance made up 17 of the 37**

*Financial companies reporting hacking incidents, by sector, 30 September to 3 November 2026*

Electronic financial services

10

Financial investment

5

Savings banks

5

Banks

4

Online P2P lending

4

Insurance

3

Virtual asset providers

3

Specialised credit finance

2

Mutual finance

1

|  | Value |
| --- | --- |
| Electronic financial services | 10 |
| Financial investment | 5 |
| Savings banks | 5 |
| Banks | 4 |
| Online P2P lending | 4 |
| Insurance | 3 |
| Virtual asset providers | 3 |
| Specialised credit finance | 2 |
| Mutual finance | 1 |

Source: FSC release, 5 November 2026 · as of 3 November 2026 · 17 of 37 is our sum of the three highlighted sectors

The FSC names no firm. Companies have named themselves: Daishin Securities, Mirae Asset Global Investments and the crypto exchange Bithumb in late October,[7] and Mirae Asset Securities, days after sister companies including Mirae Asset Life reported leaks of their own.[6]

## What was taken, and a sentence that reads differently in Korean

The English release says the records were “mostly pertaining to the information about employees, and the names, resident registration numbers, and account numbers of customers”.[1] Read quickly, that sounds like mostly employees. The Korean original lists the two together: mainly employee information or customers’ names, resident registration numbers and account numbers, collected in the course of business.[3] The FSC publishes no split between staff and customers. What it does say is that account passwords and other information that could enable fraudulent payments have not been confirmed as leaked.[3]

**Figure: The FSC counts about 473,000 records taken and about ₩1 billion stolen, with no customer funds lost yet**

*Personal records and funds reported lost to 3 November 2026; customer losses from phishing reported as of 6 November*

473,000

records of personal information, to 3 November

₩1bn

stolen, mainly from accounts pooling customer money

0

customer account passwords confirmed leaked, as of 5 November

0

customer funds lost to phishing on leaked data, to 6 November

Source: FSC releases of 5 and 6 November 2026 (English and Korean) · as of 6 November 2026

The money is about ₩1 billion, or about US$745,000 by Yonhap’s conversion.[6] Small crypto, electronic-finance and peer-to-peer firms reported it. The English says it came “mostly from their management accounts”;[1] the Korean is more specific: crypto hot wallets, spendable points and peer-to-peer deposits, in accounts where the company holds customer money together.[3] The FSC says individual users have not yet lost funds, and that as of 6 November no customer money had been reported lost to voice phishing or smishing tied to these leaks. Its consumer alert, first issued on 6 October, stays at Level I, Caution.[3][4][5]

TechBag countTechBag count: where the named firms fit

Daishin says 38,490 customers’ data leaked, including account numbers it says were encrypted. If that sits inside the 473,000, which the FSC does not confirm, it is about 8% of the total.[7] Mirae Asset Securities is the one case with a published split: account numbers of about 3,800 customers, and the personal information of over 35,000 current and former staff and contractors, about nine in ten of its 39,000. That staff data included passwords; the FSC’s statement covers customers’ account passwords and dates from before this breach was disclosed.[6]

## Where the FSC says they got in, and what it now requires

Only the Korean release says it plainly. The inspection covers authentication and access-control systems, sales and management APIs, and development, test and temporary-operation systems, which the FSC calls “the systems where recent breaches have mainly occurred”, along with peripheral systems it thinks have been neglected (our translation).[3] The English version lists the systems without that phrase.[1] The firms’ own accounts fit: Daishin, a server linked to remote account opening; Mirae Asset Global Investments, a work web system; Bithumb, an internal mobile groupware app;[7] Mirae Asset Securities, a mobile-web phone-authentication login and an internal system.[6]

**Figure: The plan starts with every external entry point at about 580 firms and ends in a new law**

*Measures announced at the 5 November 2026 meeting, with the FSC's stated dates*

Step 1 of 6

1. Inspect every external entry point

About 580 firms. Registered systems by 30 November; systems missing from the asset register, and CEO and CISO controls, by 31 December. Firms check themselves first and must write down why they passed; the FSS and the Financial Security Institute go on site if the check looks thin.

Source: FSC release of 5 November 2026 (English and Korean) · as of 9 November 2026 · Plans and proposals; the rule changes and bills are not yet adopted

The sixth step runs the other way from what a reader might expect. Korean financial firms have had to keep internal networks apart from external ones; the FSC now wants that rule gone, so firms can use AI on defence, with zero trust and other substitutes in its place.[1][3] Its summary line is that AI attacks are to be defended with AI.[3]

> A financial company that cannot protect its customers’ information and assets has already lost its reason to exist.[3]The FSC's chairman at the 5 November meeting (our translation from the Korean release)

ReportedWhat the FSC has not said

On 14 October the FSS and the Financial Security Institute said they were examining whether the incidents were connected, whether they came from the same attacker, and whether AI had been used.[2] The 5 November release is titled for “AI hacking threats” but answers none of the three.[1] It says only that AI-driven intrusion attempts may threaten the sector quickly and widely.[3] MTN reported, from material a lawmaker released, that the Institute showed a seminar on 17 September an AI-agent attack on a Korean financial firm that was blocked; that case predates the FSC’s count, and the FSC has not linked it to the 40.[8]

## India's NBFC wave: the same side doors, a different kind of loss

India’s lenders have been under attack in the same weeks, and the entry point looks familiar. CERT-In’s advisory of 4 November describes “Internet-exposed non-production environments (UAT/staging/testing) used as entry points, followed by movement to production environments using shared credentials, tokens or network paths”.[9] The FSC names development and test systems too.[3] Neither regulator links the two waves. What differs is what went missing, and who has counted it.

**Figure: Korea's regulator has published a count; India's figures come from unnamed sources and a police complaint**

*What each country's regulator and reports state, South Korea to 7 November and India to 4 November 2026*

India: not published by a regulator

- No count of incidents or firms in CERT-In’s advisories or any RBI notice we found
- No official loss figure; about ₹300 crore in two months is The Economic Times’ unnamed sources
- No victim named by CERT-In; one Mumbai case of about US$2 million comes from a police complaint Reuters read
- No sector-wide inspection list with dates that we found; Reuters reports the RBI asking banks to probe their API links

South Korea: published by the FSC

- 40 incidents at 37 firms, by sector, 30 September to 3 November
- About 473,000 records and about ₩1 billion in stolen funds
- The system types where breaches mainly occurred: sign-in, APIs, development and test
- About 580 firms to inspect, with deadlines of 30 November and 31 December

Source: FSC releases; CERT-In CIAD-2026-0058; The Economic Times; Reuters via The420.in · as of 9 November 2026 · We found no Indian regulator's count; neither regulator connects the two waves

Korea’s wave, so far, is mainly about records. India’s, as reported, is about money moved through payment and disbursement APIs: The Economic Times put losses at small NBFCs at about ₹300 crore, citing unnamed sources,[10] and a police complaint read by Reuters puts one case, two Mumbai lenders and more than 700 transfers, at about US$2 million.[11] That single reported case is more than Korea’s reported total of about US$745,000.[6] We covered the Indian figures and who stands behind them in [our 1 November note](https://www.thetechbag.com/blog/nbfc-api-attacks-300-crore-rbi-checks).

What an Indian lender can borrow from Korea's inspection list

The duties already exist. CERT-In’s Directions of 28 April 2022 require unauthorised access to IT systems or data to be reported within six hours of noticing it.[12] Its 4 November advisory asks firms to isolate test and staging systems from production, with “no shared credentials, tokens, API keys, databases or direct network paths”.[9] Our note on [that advisory](https://www.thetechbag.com/blog/cert-in-crafty-falcon-nbfc-payment-attacks) has the full control list, and the [BFSI obligations guide](https://www.thetechbag.com/industries/bfsi/obligations) maps the RBI and SEBI rules beside it.

Our viewOur view: three checks from the FSC's plan

Can you list every internet-facing system, including the ones nobody registered? The FSC gave unregistered systems their own, later deadline. Are sales and admin APIs, test systems and temporary deployments inside the scope of your outside penetration test, and is that test more frequent than once a year? And if a critical flaw turns up on a running service, who has the authority to shut it, and who must sign to keep it on? The [vulnerability management guide](https://www.thetechbag.com/browse/security/vulnerability-management) compares tools for finding what is exposed.

How we did this

Figures as of 9 November 2026, 7pm IST

Counts, sector figures, measures and dates are the FSC’s, from its English releases read with the Korean releases of 5 and 6 November. Where the two differ we followed the Korean and said so; translations from Korean are ours. The FSC’s records figure is its own “cases” of personal information; it does not define the unit further. The FSC names no firm: firm cases are the companies’ statements as reported by HuffPost Korea and by Yonhap in The Korea Herald, and we could not find Mirae Asset Securities’ own notice. The dollar conversion is Yonhap’s. Indian figures are labelled by source. Day counts and percentages are our arithmetic. No attacker is named or attributed here, and coverage that speculates about one is not used.

Spotted an error? Write to us; corrections are published at the foot of the piece.

Sources

1. [Financial Services Commission, FSC Holds Meeting on Strengthening Cyber Defense Framework amid Growing AI Hacking Threats (English release)](https://www.fsc.go.kr/eng/pr010101/88092) — 5 November 2026
2. [Financial Services Commission, Authorities Hold Meeting on Cybersecurity Management in Financial Sector to Bolster Anti-Hacking Measures](https://www.fsc.go.kr/eng/pr010101/87928) — 14 October 2026
3. [Financial Services Commission, Korean release on the sector-wide meeting on security in the AI era (incident figures, systems inspected, deadlines, enforcement)](https://www.fsc.go.kr/no010101/88086) — 5 November 2026
4. [Financial Services Commission, Korean release on preventing voice phishing after data leaks (special response period extended to end-December)](https://www.fsc.go.kr/no010101/88098) — 6 November 2026
5. [Financial Services Commission, FSC-FSS Issue Consumer Alert over Potential Phishing Scams Following Data Breaches in Financial Sector](https://www.fsc.go.kr/eng/pr010101/87887) — 6 October 2026
6. [The Korea Herald (Yonhap), Personal info of some 39,000 leaked from Mirae Asset Securities](https://www.koreaherald.com/article/10929242) — 7 November 2026
7. [HuffPost Korea, report on the Daishin Securities, Mirae Asset Global Investments and Bithumb breaches (company statements)](https://www.huffingtonpost.kr/article/261594) — 28 October 2026
8. [MTN, report on the Financial Security Institute's warning before the breaches (material released by a National Assembly member)](https://news.mtn.co.kr/news-detail/2026101111071676422) — 11 October 2026
9. [CERT-In, CIAD-2026-0058: advisory on AI-driven attacks on BFSI entities](https://www.cert-in.org.in/s2cMainServlet?pageid=PUBVLNOTES02&VLCODE=CIAD-2026-0058) — 4 November 2026
10. [The Economic Times, AI-powered cyberattacks siphon ₹300 crore from small NBFCs in two months](https://economictimes.indiatimes.com/industry/banking/finance/ai-powered-cyberattacks-siphon-300-crore-from-small-nbfcs-in-two-months/articleshow/135278215.cms) — 29 October 2026
11. [Reuters, via The420.in: RBI seeks proof of cybersecurity compliance from banks after recent hacks](https://the420.in/?p=3314) — 30 October 2026
12. [CERT-In, Directions under section 70B(6) of the IT Act (six-hour reporting; Annexure I item iii)](https://www.cert-in.org.in/PDF/CERT-In_Directions_70B_28.04.2022.pdf) — 28 April 2022

**Disclosure.** TechBag is a software reseller: it earns a margin when a reader buys through it, including from vendors named here. The analysis is TechBag’s own; no vendor paid for or saw this piece before publication. Facts are labelled reported, TechBag count or our view.

**Read this next:** [CERT-In names ‘CRAFTY FALCON’: NBFCs that remediated were attacked again](https://www.thetechbag.com/blog/cert-in-crafty-falcon-nbfc-payment-attacks) — India’s parallel wave, by its regulator: CERT-In says NBFCs that had remediated were attacked again, and lists four AI tools and ₹1 test transfers.

Go deeper on TechBag

- [Small NBFCs reportedly lost ₹300 crore](https://www.thetechbag.com/blog/nbfc-api-attacks-300-crore-rbi-checks) — the Indian wave’s figures, and who stands behind each one
- [BFSI obligations: RBI, SEBI and CERT-In duties, dated](https://www.thetechbag.com/industries/bfsi/obligations) — the six-hour reporting clocks an Indian lender runs after an incident
- [Vulnerability management guide](https://www.thetechbag.com/browse/security/vulnerability-management) — tools for finding internet-facing systems and the flaws in them, the first step of Korea’s inspection