MIRAE ASSET Life has confirmed that attackers stole customer personal and credit data from its systems, and according to reports it is the first Korean insurer to disclose a hacking leak in the wave of attacks that has hit the country’s financial sector since late September. The company says it spotted abnormal activity in its customer application system and parts of its website on Oct 25, Korea time, then confirmed the leak with an outside security firm early on Oct 26.
MIRAE has not yet said how many customers are affected or exactly which data fields were taken. Reports citing people familiar with the case say the attacker viewed about 41 files, but the company has not confirmed that figure.
What MIRAE has done so far
The insurer blocked the attacking IP addresses, stood up an emergency response team and took its public website offline, where visitors now see only an outage notice. It posted an apology, warned customers about smishing and voice phishing, and promised individual notices once victims are identified.
Korea’s Financial Supervisory Service (FSS) opened an urgent on-site inspection on Oct 26. The regulator says it will check whether the method used against MIRAE matches the earlier bank attacks. No link has been confirmed, so any connection remains possible but unproven.
KB Kookmin Bank’s victim count jumps from 119 to 2,210
The MIRAE disclosure landed the same day KB Kookmin Bank sharply raised its own numbers. According to KB’s official notice, another 2,091 people were affected, made up of 1,631 customers and 460 current or former employees. That brings the total to 2,210, or 1,730 customers and 480 staff, up from the 119 victims KB first announced on Oct 2.
KB says this was not a new attack. Reports say the gap surfaced during the FSS’s routine inspection of the bank. The bank also says the number of exposed data types grew from 17 to 39, and most affected customers had about 4 of those fields exposed. The data includes:
- Names, dates of birth, gender and encrypted national ID numbers
- Home and work addresses, phone numbers, email and marital status
- Job details and personal and household income
- Deposit balances, account numbers, contract amounts and loan history
- Credit ratings, overdue card principal and debt restructuring applications
For employees, the exposed data covers employee numbers, names in Korean and English, mobile numbers, emails, branches, and appointment and departure dates. The notice refers to KB Kookmin Bank only. Regulators have said no card company has reported a hacking leak, and the FSS inspection at KB Kookmin Card is a routine review.
KB says it is notifying victims by text, email and mail, offers a lookup on its homepage, and has promised to compensate any losses in full. It also says it never sends links in leak-related texts. During a parliamentary audit on Oct 19, an opposition lawmaker claimed a tip that a KB security executive had mentioned deleting logs. KB’s CEO said he had never been told of this, and the claim remains unverified.
An AI-assisted attacker and no named group
In an Oct 7 analysis of the earlier bank intrusions, CrowdStrike said the activity was not attributed to a named adversary. It assessed with moderate confidence that the attacker is likely a Chinese speaker and financially motivated, and said the intruder used an open-source AI hacking tool called ARTEX, run on the DeepSeek model from servers based in Hong Kong. The report also says the attacker asked an AI system where to sell Korean breach data.
On Oct 14, regulators said 16 firms had been hit and about 100,000 records leaked, including at savings banks, Hyundai Capital, a national credit-union body and two crypto firms. They said no account passwords or card numbers were found in the leaked data. A security checklist sent to 555 firms found 130 with gaps such as unpatched systems, end-of-support software, missing multi-factor authentication and no 24-hour monitoring.
Regulators say the same attacker IP addresses showed up at several commercial banks, while the savings banks and Hyundai Capital saw different IPs and similar methods. Many of the IPs were proxies or VPNs. The common thread is outward-facing support systems such as loan-agent portals, staff mobile apps and sales-support tools, not core internet banking.
Separately, Seoul police said on Oct 26 that they arrested 7 people accused of hacking about 90 Korean companies and stealing more than 8.2 million records, using the same AI hacking tool. Police have not linked that group to the bank intrusions.
What customers should watch for
Income, loan history and credit data give fraudsters strong material for convincing impersonation calls and texts, which is why both MIRAE and KB are warning about smishing and voice phishing. Customers of either company should treat unsolicited messages about the incident with suspicion and check notices only through the companies’ official channels.
MIRAE’s victim count and data list are still pending, and regulators say more affected firms may surface. Financial-sector breaches have been drawing similar scrutiny elsewhere, including the NAIC cyberattack that disrupted insurance systems and the Standard Bank and Liberty breaches in South Africa.
