Mirae Asset Securities has confirmed 2 cyberattacks that exposed account numbers belonging to about 3,800 customers and personal information belonging to approximately 35,255 current, former and outsourced employees.
The South Korean brokerage published separate customer and employee notices on November 7, 2026. It said the attacks targeted its mobile-web phone-authentication login service on November 4 and its internal groupware platform, mi-global, on November 5.
The disclosures describe different affected systems and different categories of information. The company has not publicly established whether the same attackers carried out both incidents.
Customer account numbers exposed through login service
In its customer breach notice, Mirae Asset Securities said abnormal external access to the mobile-web login service exposed 1 category of customer information: account numbers for accounts held at the brokerage.
About 3,800 customers were affected. The company said account-holder names and other information associated with those accounts were not exposed in that incident.
After identifying the exposure, the brokerage urgently suspended the affected service and blocked further access. It said the service remained disconnected from external access while investigators examined vulnerabilities, the cause of the incident and how the information was exposed.
The disclosure does not identify a software flaw, an attacker or an extortion demand. It also does not establish that anyone used the exposed account numbers to carry out unauthorized transactions.
Groupware breach affects a separate employee dataset
The company’s employee notice describes an external attack against mi-global on November 5. Mirae Asset Securities confirmed that approximately 35,255 people were affected, including former staff and outsourced workers.
Most of the exposed employee information consisted of names and employee numbers. Some records also contained email addresses, mobile phone numbers and encrypted passwords. The precise combination varied by individual.
The company did not disclose how the passwords were protected. Describing them as encrypted does not establish whether they were stored using a strong password-hashing scheme or whether attackers could recover them.
Mirae Asset Securities said it disconnected the affected server from the network, blocked external connections to the groupware and related mobile services, and expanded its review to other internal systems accessible from outside the company.
Impersonation is the immediate concern
The brokerage warned that attackers could use the exposed information to impersonate the company or colleagues through phone calls, text messages and email. Knowing a person’s account number, name or employee number does not make an incoming request legitimate.
Customers should reach the brokerage through its official website or app rather than links in unexpected messages. The company advised customers to change their cyber ID password through its official website and review recent orders, completed trades, deposits, withdrawals and transfers in the MAPS app.
Employees should independently verify unusual work requests using contact details they already trust. They should not share passwords or authentication codes, open unexpected attachments or install software at a caller’s direction.
The incident follows the separately reported Mirae Asset Life customer data breach. The similar corporate names do not establish a shared intrusion route or attacker. The 2 notices from Mirae Asset Securities leave the initial access methods and any connection between its customer and employee breaches unresolved.
