South Korea | November 10, 2026

The Mirae Asset data breach has raised serious questions about cybersecurity across South Korea’s financial sector after four affiliates of the financial group experienced cyber incidents within a period of less than two weeks. The incidents involved customer information, employee records and internal business systems, prompting regulatory inspections and concerns about whether the attacks may share common methods or entry points.

The most serious confirmed disclosures involve Mirae Asset Life Insurance and Mirae Asset Securities. The insurance company reported that personal and credit information had been exposed, while the brokerage disclosed that customer account numbers and employee information were accessed. Other group affiliates also reported suspicious external activity or internal data exposure.

South Korea’s Financial Supervisory Service (FSS) began an on-site inspection of Mirae Asset Securities on November 9. Authorities are examining the scope of the exposure, how the incidents occurred and whether the attacks against different affiliates are connected.

The Mirae Asset data breach is particularly significant because the incidents affect different parts of a major financial group, raising concerns that cybersecurity weaknesses may extend beyond a single application or business unit.

1. Four Mirae Asset Affiliates Face Cybersecurity Incidents

The incidents emerged between October 26 and November 5, 2026, involving four companies within Mirae Asset Group.

Mirae Asset Life Insurance disclosed a customer-information leak on October 26 after detecting abnormal activity in parts of its systems. Mirae Asset Global Investments reported unauthorized access and data exposure involving internal work systems on October 28. Energy Infrastructure Asset Management identified signs of external intrusion on November 2. Mirae Asset Securities subsequently disclosed attacks affecting its systems on November 4 and 5.

The sequence has attracted attention because the incidents occurred across different affiliates over a short period. However, the timing alone does not establish that one attacker or coordinated campaign was responsible.

The Mirae Asset data breach investigations must therefore establish whether the incidents involved common infrastructure, shared credentials, similar vulnerabilities or entirely separate intrusion methods.

DigitalToday reported on November 9 that the FSS was examining possible links between the incidents, including similarities in intrusion routes and attack methods. The regulator was also conducting inspections involving Mirae Asset Life Insurance and Mirae Asset Global Investments.

At this stage, no publicly confirmed technical evidence establishes a single threat actor or common attack chain across all four affiliates.

2. Securities Breach Exposes Approximately 39,000 Records

The most recent major disclosure came from Mirae Asset Securities, which reported unauthorized external access to two separate systems.

The first incident involved its mobile web phone-authentication login service on November 4. The second affected its internal groupware system, known as mi-global, on November 5.

According to the company’s disclosure reported by Yonhap and other South Korean media, account numbers belonging to approximately 3,800 customers were exposed. Personal information associated with 35,255 current and former employees, retirees and outsourced workers was also affected.

The employee information included names, employee identification numbers, email addresses, mobile phone numbers and encrypted passwords.

These figures represent approximately 39,000 customer and employee records or affected data subjects as reported by the company. They should not automatically be interpreted as 39,000 unique individuals across every incident involving the wider group.

The Mirae Asset data breach at the brokerage is especially concerning because the exposed information includes both customer account identifiers and employee-related information. Although the company said account-holder names and other sensitive customer information were not included in the securities disclosure, account numbers can still provide useful context for criminals attempting to impersonate financial institutions or their customers.

The company said it detected abnormal activity from external IP addresses, blocked the affected access routes and activated its emergency response procedures. It also reported the incidents to relevant financial and personal-information regulators.

3. Life Insurance Disclosure Includes Sensitive Customer Information

The earlier incident at Mirae Asset Life Insurance involved a different and potentially more sensitive category of information.

The company detected abnormal system activity on October 25 and confirmed a personal-information leak during the early hours of October 26 after working with an external specialist organization.

Its public notice lists several categories of information that may have been exposed. These include customer names, resident registration numbers, dates of birth, telephone numbers, email addresses, residential addresses, linked identification information, bank names, account numbers, account-holder details and signatures.

The notice also identifies information associated with retirement pension transactions and website services. Some records could include copies of identification documents, bankbook-related information and retirement-income documentation. The company emphasized that the exposed information differed between customers.

This disclosure makes the Mirae Asset data breach more serious than an incident limited to ordinary contact details. Financial and identity information can be combined to make fraudulent communications appear more convincing.

Subsequent reporting by The Elec said approximately 6,800 Life Insurance customers were affected. That figure was attributed to reporting on the investigation and should be treated as a reported estimate rather than a number independently confirmed in the company’s public notice.

The insurer activated an emergency response, blocked attacking IP addresses and strengthened security measures. It also warned customers about possible secondary crimes, including phishing, smishing and identity misuse.

4. Internal Systems at Other Affiliates Also Came Under Scrutiny

The incidents at Mirae Asset Global Investments and Energy Infrastructure Asset Management broaden the investigation beyond the two affiliates with confirmed customer-information disclosures.

Mirae Asset Global Investments said unauthorized external access had affected some internal work systems. The company reported that information used in certain internal systems had been exposed, but said general customers’ personal and credit information was not compromised.

The company also said it had not identified malware infection or disruption to its main services. It blocked the relevant access routes, activated its emergency response procedures and began investigating the incident with external cybersecurity specialists.

Energy Infrastructure Asset Management was identified in reporting as another affiliate where signs of external intrusion were detected on November 2. Public reporting available at the time of writing did not establish a confirmed customer-data leak from that affiliate.

These distinctions matter. A security incident, unauthorized access and confirmed personal-data exposure are not interchangeable descriptions.

The Mirae Asset data breach investigation should not be interpreted as proof that every affiliate suffered the same type or scale of compromise. Each company’s systems, exposed information and response measures need to be assessed separately.

Nevertheless, the repeated incidents raise questions about how security risks are identified and managed across a financial group with multiple businesses and technology environments.

5. Financial Supervisory Service Begins On-Site Inspection

South Korea’s Financial Supervisory Service began an emergency on-site inspection of Mirae Asset Securities on November 9.

According to ChosunBiz, the regulator is examining the scale of the exposure, how unauthorized access occurred and whether customers suffered harm. The duration of the inspection will depend on what investigators discover.

DigitalToday reported that the regulator was also examining whether the incidents at different Mirae Asset affiliates shared common intrusion routes, attack methods or weaknesses in internal security controls. Inspections were also under way at Mirae Asset Life Insurance and Mirae Asset Global Investments.

The regulatory response is important because the Mirae Asset data breach involves more than one financial business. Investigators may need to examine how security responsibilities, monitoring processes and incident reporting operate across separate affiliates.

The investigation could also clarify whether the incidents were isolated events or reflected broader weaknesses in the group’s security management framework.

However, an inspection does not itself establish regulatory violations, negligence or a coordinated attack. Those conclusions require evidence and formal findings.

6. Seven Major Risks for Customers and Employees

The exposed information creates several potential risks, even though the available disclosures do not confirm direct financial losses from the securities incidents.

1. Targeted phishing: Criminals may use names, email addresses, phone numbers and employer information to make fraudulent messages appear legitimate.

2. Financial impersonation: Exposed account numbers could help attackers construct convincing communications that appear to come from a brokerage or financial service provider.

3. Identity misuse: The Life Insurance disclosure includes highly sensitive identity information. If misused, such information could support attempts to impersonate affected individuals.

4. Smishing and voice phishing: Attackers may send text messages or make calls pretending to be Mirae Asset representatives, regulators or customer-support personnel.

5. Employee-targeted attacks: Exposed employee contact details and encrypted passwords could increase the risk of targeted social engineering. The presence of encrypted passwords does not mean they have been decrypted or successfully reused.

6. Retirement and banking fraud: The Life Insurance notice identifies retirement-pension and bank-related information among the potentially exposed categories. Criminals could attempt to exploit such details in tailored scams.

7. Wider trust and compliance concerns: Repeated incidents across affiliates may affect customer confidence and lead to closer scrutiny of security governance, access management and incident response.

These are potential consequences, not confirmed outcomes. The Mirae Asset data breach investigations have not established that every exposed record has been used for fraud or that customer accounts have been accessed to withdraw money.

7. What Mirae Asset Has Done and What Remains Unknown

Mirae Asset companies have reported several immediate containment measures, including blocking suspicious IP addresses, restricting access to affected systems and activating emergency response procedures.

Mirae Asset Securities said it disconnected affected services or systems from external access while investigating vulnerabilities and the circumstances of the incidents. The company also reported the incidents to relevant authorities.

Mirae Asset Life Insurance strengthened security measures and temporarily restricted some online services. Its customer notice introduced stronger authentication arrangements and warned users to be cautious of suspicious communications.

The companies’ responses are important, but containment is only one part of an effective incident investigation. Authorities and affected organizations still need to establish how access was obtained, what information was actually viewed or taken, whether any credentials were misused and whether further exposure remains possible.

Several questions remain unanswered:

• Were the incidents at the four affiliates carried out by the same threat actor?
• Did attackers exploit shared infrastructure, compromised credentials or separate software weaknesses?
• How much information was actually downloaded or copied?
• Were any exposed employee credentials subsequently used to access other systems?
• Have investigators identified any direct financial losses or confirmed secondary fraud?
• What additional security changes will be required across the group?

The Mirae Asset data breach should therefore be treated as an evolving investigation rather than a fully understood attack campaign. Further disclosures from the companies and regulatory authorities may change the understanding of its scope.

What Customers and Employees Should Do

Customers and employees should remain alert to messages, calls and emails that refer to their accounts, employment records, insurance policies or personal information.

They should avoid clicking links from unknown senders, refuse unexpected requests for passwords or financial details, and independently verify communications by contacting the relevant company through its official channels.

Employees should follow their organization’s password-reset and security instructions. Where passwords may have been exposed, users should change them through official services and avoid reusing the same password across different accounts. Multi-factor authentication should be enabled wherever available.

Customers should also monitor account activity and report suspicious transactions or communications promptly. Anyone who receives a message claiming that their information was exposed should verify the notice independently rather than relying on links or telephone numbers included in the message.

The Mirae Asset data breach demonstrates why customers should take impersonation attempts seriously even when a company has not confirmed direct financial losses.

Conclusion

The incidents affecting four Mirae Asset affiliates have created a significant cybersecurity and regulatory challenge for one of South Korea’s major financial groups. The disclosures range from sensitive customer and credit information at Life Insurance to customer account numbers and employee records at Securities, alongside internal-system exposure and suspicious activity at other affiliates.

The Financial Supervisory Service’s inspections may help establish whether the incidents share technical links and whether broader security weaknesses contributed to the sequence of events.

For now, the Mirae Asset data breach remains an active investigation. The full scale of the incidents, the identity of those responsible and the possibility of further consequences have not been conclusively established.

Source note: This report draws on Mirae Asset Life Insurance’s public customer notice and reporting by Yonhap News Agency, ChosunBiz, DigitalToday, The Elec and other South Korean news organizations. The relationship between the incidents at the four affiliates has not been established publicly, and reported figures should be distinguished from independently confirmed totals.

NewsFlayer — Bringing You the Latest Cybersecurity News from Around the World.