SockAnalystMirae Asset Securities hacked twice in two days: 3,800 customer account numbers and 35,255 staff records leaked
SockAnalyst · Security+ certified analyst.
What happened
South Korean brokerage Mirae Asset Securities said on November 7, 2026 that outsiders accessed its systems on November 4 and 5. The first intrusion hit its mobile-web login service that uses phone authentication and exposed about 3,800 customer account numbers; the company says account holder names, passwords and balances were not leaked. The second hit its in-house groupware, mi-global, and exposed data on 35,255 current, former and outsourced staff: mostly names and employee numbers, with some email addresses, mobile numbers and encrypted passwords. The company says no resident registration, passport or driver's license numbers leaked, there was no malware or service disruption, and no customer financial losses have been found. It blocked the access paths after spotting abnormal external IPs, cut external connections to the groupware and related mobile services, and reported to Korea's FSC, FSS and PIPC. It is the fourth Mirae Asset Group affiliate hit since October 26. How the attackers got in has not been disclosed.
Who's affected
About 3,800 Mirae Asset Securities customers (account numbers) and 35,255 current, former and contract employees. Everyone in those groups is a phishing and smishing target, since attackers who know names, employee numbers or account numbers can impersonate the company or co-workers.
✅ Fix / patch
- Mirae customers and staff: ignore calls, texts and emails claiming to be Mirae even if they quote your name, employee ID or account number; never share passwords or one-time codes or install programs on request; verify via known numbers (customer center 1588-6800).
- Staff: change your groupware password and any password reused elsewhere, since encrypted password values were exposed.
- Financial-sector defenders: review internet-facing login services that rely on phone/SMS authentication for enumeration or brute-force patterns, and restrict groupware/webmail exposure to VPN or conditional access.
- Tune phishing defenses for lures impersonating Korean financial brands; this is the fourth Mirae affiliate and follows other Korean brokerage breaches.
🔎 Quick hunt check
No IOCs published. Mirae has not released attacker IPs, tools or the intrusion method. Hunt for one source IP hitting many accounts on phone-auth or OTP login endpoints, sudden spikes in account-lookup responses, and bulk directory/profile reads or large exports from groupware by a single session.
MITRE ATT&CK: T1078, T1110, T1133, T1213, T1530
IOCs
No IOCs (IPs, domains or hashes) published by the sources yet.
Hunt queries
Starting points built only from published indicators. Field names vary; tune before use.
index=web (sourcetype=access_combined OR sourcetype="ms:iis:auto" OR sourcetype="aws:waf")
(uri_path="*login*" OR uri_path="*auth*" OR uri_path="*otp*" OR uri_path="*verify*")
| bin _time span=10m
| stats dc(user) as accounts dc(uri_path) as paths count as reqs values(status) as statuses by _time, src_ip
| where accounts>=20 OR reqs>=200
| sort - accounts
// One source enumerating many accounts on phone/OTP login flows = Mirae-style login abuse; then check what data those responses returnedlet window = 30d;
let loginAbuse = W3CIISLog
| where TimeGenerated > ago(window)
| where csUriStem has_any ("login","auth","otp","verify")
| summarize Reqs=count(), Accounts=dcount(csUserName), Statuses=make_set(scStatus) by cIP, bin(TimeGenerated, 10m)
| where Accounts >= 20 or Reqs >= 200;
let bulkGroupware = OfficeActivity
| where TimeGenerated > ago(window)
| where Operation in ("FileDownloaded","FileSyncDownloadedFull","SearchQueryPerformed","MailItemsAccessed")
| summarize Ops=count(), Items=dcount(OfficeObjectId) by UserId, ClientIP, bin(TimeGenerated, 1h)
| where Items > 500;
loginAbuse | extend Signal="login-enumeration" | union (bulkGroupware | extend Signal="bulk-groupware-read")
// Adapt table names to your web/groupware logs; flags login enumeration and mass internal data pulls⏱ CISA deadline
Not in CISA KEV as of Nov 14, 2026.
Sources
Related playbooks
- Iris Ohyama's Iris Plaza breach: about 7.7 million people's data may be exposed via an external cloud service · Data breach · 2026-11-09
- Apify breach: compromised credential exposed customer accounts, 2FA recovery codes and sign-in tokens · Data breach · 2026-11-14
- DreamHost File Manager breach: FTP/SFTP passwords and some webmail sessions stolen · Breach · 2026-11-06
Get the Weekly KEV & Hunt Pack free — plus the daily SOC brief.
Weekly email; daily brief on the website.
Subscribe free