Daishin Securities bowed in apology, saying a hack leaked the personal information of 38,490 customers. The leaked information comprises eight items, including customer names, emails and addresses.
On the 28th, Daishin Securities disclosed the scale of damage confirmed so far through an internal investigation and said it is preparing protection measures for affected customers and measures to prevent recurrence. Jin Seung-wook, CEO of Daishin Securities, said, "We take this personal information leak extremely seriously and deeply apologize to our customers," adding, "We will responsibly carry out the measures needed to protect customers and prevent recurrence."
The incident came to light on the 17th, when traces of abnormal access by a hacker were found on a server linked to the opening of non-face-to-face discretionary investment securities accounts. As soon as it detected the abnormal access, the company took emergency action, including blocking the IP addresses used in the attack and the bypass IP addresses.
It then reported immediately to the regulators and, together with the Korea Financial Security Institute, closely investigated the scope of the breach. After examining all of the more than 60,000 signals disguised as normal service, it found on the 26th that eight items had been leaked: customer names, emails, addresses and communication IDs, along with bank names, encrypted deposit and withdrawal account numbers, Daishin Securities comprehensive account numbers and mobile phone numbers.
The company explained that no signs of secondary damage to customers have emerged so far, and that there was no illegal access by the hacker targeting core business systems.
Daishin Securities said it will individually notify affected customers of the items that were leaked and will act immediately if damage emerges. It plans to reinforce access controls on the server in question and its systems for detecting and blocking anomalies, and to expand security vulnerability checks on externally linked systems. Customers who suffered losses from the leak of personal (credit) information will be compensated in accordance with laws and procedures.