The personal and credit information of 38,490 Daishin Securities customers was leaked in a hack.
On the 28th, Daishin Securities said it will individually notify affected customers of the leak and put in place measures to prevent a recurrence. According to the company, signs of abnormal access by a hacker were detected on the 17th on the server linked to opening non-face-to-face securities accounts for discretionary investment management. The company is said to have blocked the Internet address (IP) used in the attack and the bypass access IP, reported the incident to regulators, and then investigated the extent of the breach together with the Financial Security Institute.
A full inspection over ten days of some 60,000 signals disguised as normal service requests confirmed on the 26th that customer information had been leaked. The leaked information covers eight items: △ customer name △ email △ address △ communication ID △ bank name △ deposit/withdrawal account number △ Daishin Securities comprehensive account number △ mobile phone number. Among these, the deposit/withdrawal account number, the comprehensive account number and the mobile phone number were encrypted, the company explained.
Daishin Securities said that it has so far found no signs of secondary damage or illegal access to core business systems. If damage is confirmed, it will act quickly and compensate customers who suffer losses in accordance with laws and procedures. It also plans to strengthen access control and the anomaly detection and blocking system for the server in question and to inspect security vulnerabilities in externally linked systems.
Daishin Securities CEO Jin Seung-wook said, "We take this leak of personal and credit information very seriously and deeply apologize to our customers. We will responsibly carry out the measures needed to protect customers and prevent a recurrence."