South Korea Faces New Cyberattacks on Financial Firms as AI Security Risks Grow

South Korea's financial sector is facing another wave of cyberattacks, with a securities firm, an investment manager, and a cryptocurrency exchange reporting security incidents. The latest cases are raising fresh concerns about how well financial institutions are protecting customer information and internal systems as cyber threats become increasingly sophisticated.

The incidents involve Daishin Securities, Mirae Asset Global Investments, and cryptocurrency exchange Bithumb. They follow a series of attacks against South Korean financial institutions in recent weeks, putting additional pressure on companies and regulators to strengthen their cybersecurity defenses.

Daishin Securities reports customer data exposure

Daishin Securities reported that a cyberattack exposed the personal information of 38,490 customers. The compromised information included names, email addresses, and mobile phone numbers.

The company said it had notified affected customers and was cooperating with authorities. It also indicated that customers who suffer losses would be compensated in accordance with applicable laws.

The incident highlights the risks financial firms face when systems connected to customer onboarding and other online services become targets. Even when an attack does not directly affect trading operations, exposed personal information can be used in phishing campaigns, impersonation attempts, and other forms of fraud.

Customers affected by such breaches may need to be especially cautious about unexpected calls, emails, or text messages claiming to come from their financial institution.

Bithumb and Mirae Asset investigate separate incidents

Bithumb, one of South Korea's cryptocurrency exchanges, also reported a security incident involving unauthorized access to an internal mobile groupware system operated through a third-party platform.

The exchange said the affected system was separate from its customer-facing trading network and that customer assets had not been affected. It reported the incident to the relevant authorities and began investigating whether any customer information had been exposed.

Mirae Asset Global Investments separately confirmed unauthorized access to some of its web systems. The company said it blocked the access routes and launched an emergency response after discovering that information from internal business systems had been exposed.

Its preliminary findings did not indicate that sensitive personal information, credit data, or investor information had been compromised. The company reported the incident to financial regulators and brought in external cybersecurity specialists to help investigate what happened.

Although the incidents differ in their reported scope and impact, they illustrate why companies need to protect internal business systems as carefully as the platforms customers use directly.

A wider wave of attacks on South Korea's financial sector

The latest reports come after several South Korean banks and other financial institutions disclosed security incidents earlier in October. The growing number of cases has prompted renewed scrutiny of the country's financial cybersecurity practices.

Authorities have been investigating whether artificial intelligence tools played a role in some of the earlier attacks. Security researchers previously linked a September wave of incidents to a suspected China-based actor who reportedly used an AI-assisted penetration-testing tool called Artex.

Investigators have not established that the latest incidents involving Daishin Securities, Bithumb, and Mirae Asset were carried out by the same actor or used the same techniques.

That distinction matters. A series of attacks occurring around the same time does not, by itself, prove that they share a common source or method.

Still, the possibility that AI tools could help attackers identify weaknesses and automate parts of their operations has become a growing concern for financial institutions and cybersecurity teams.

Regulators call for stronger defenses

South Korea's financial regulators are responding to the incidents with increased scrutiny of the industry. The Financial Supervisory Service has sent inspectors to Daishin Securities and is assessing the situations involving Bithumb and Mirae Asset, alongside its continuing investigation into a separate breach at Mirae Asset Life Insurance.

Financial authorities have also called on institutions to strengthen their defenses and address security weaknesses before they are exploited. Planned inspections of private-sector IT systems are part of the broader effort to improve the detection and prevention of cyberattacks.

The cases also raise questions about how companies manage the security of systems that are not central to their main services. Internal collaboration platforms, business applications, websites, and customer onboarding systems can all provide potential entry points if they are poorly secured.

Organizations therefore need a comprehensive approach that covers the entire technology environment, rather than focusing only on the systems that directly hold money or process transactions.

What the incidents mean for customers and businesses

For customers, a data breach can create risks that extend beyond the initial incident. Stolen contact details may be used to craft convincing messages designed to trick people into revealing passwords, verification codes, or financial information.

Customers should be wary of unsolicited communications asking them to confirm account details or move funds. When a message appears to come from a bank, brokerage, or cryptocurrency exchange, it is safer to contact the institution through its official website or application rather than using links or phone numbers provided in the message.

Financial institutions, meanwhile, need to maintain strong access controls, monitor unusual activity, review third-party services, and respond quickly when suspicious access is detected. Regular security testing and clear incident-response procedures can help reduce the impact of an intrusion.

The latest incidents also reinforce the importance of communicating clearly with customers when personal information may have been exposed. Timely notification and practical guidance can help people take steps to protect themselves.

Cybersecurity remains a growing challenge

South Korea's latest financial-sector incidents show how cybersecurity risks can spread across different types of organizations, from traditional investment firms to cryptocurrency platforms.

AI-assisted tools may make some stages of cyberattacks faster or easier to automate, but the extent to which AI was involved in each case still needs to be established through investigation. Effective defenses continue to depend on sound security practices, careful monitoring, and a coordinated response when incidents occur.

As regulators examine the latest breaches, financial companies face a clear challenge: protecting customer trust requires more than responding after an attack. It requires identifying weaknesses early, securing every part of their technology infrastructure, and being prepared to act quickly when defenses are tested.