Mirae Asset Securities said on 7 November 2026 that unauthorised access on 4 and 5 November leaked about 3,800 customer account numbers and personal information of 35,255 current staff, former staff and contractors. The catalog entry records those two populations separately. Combined they are 39,055 people. The firm said customer names were not in the customer take. Employee fields included names, employee IDs, emails, mobile numbers and passwords, which Seoul Economic Daily described as encrypted. Resident-registration numbers, passports and driver licences were not leaked, the firm said.
This is not the October Mirae Asset Life Insurance incident. That was a sister company. Yonhap noted the brokerage leak came days after sister firms, including the life insurer, had similar leaks. Cataloguing them as one row would mix a life-policy file with a brokerage account-number file. They stay separate.
What happened at Mirae Asset Securities?
Two access paths, one day apart. On 4 and 5 November an outside party reached the mobile-web phone-authentication login used by customers and the internal groupware system known as mi-global. The firm said it saw abnormal access from external IP addresses, blocked those routes, stood up an emergency response, and reported to the Financial Services Commission, the Financial Supervisory Service and the Personal Information Protection Commission. An official told Seoul Economic Daily there was no malware infection and no service outage, and that the website and major systems kept running. The description is "viewing data without proper authorisation," not a claim that trading engines were rewritten.
Co-chief executives Kim Mi-sub and Hur Sun-ho posted customer and employee notices on the brokerage site the same day. The customer notice is about account numbers. The employee notice is about staff PII. If you only read an English headline that says "39,000 individuals," you miss that most of that number is workforce, not clients.
Korea's brokerage and insurer leaks this autumn sit next to the M1 Singapore telco notice in one way only: the first public statement can be a field list without a long forensic essay. The work for a customer is still to freeze the obvious fraud paths and ignore copycat "FSS reimbursement" texts.
What data was leaked?
Customers: account numbers only, about 3,800, according to the firm. It said other sensitive customer information such as names was not compromised. An account number without a name is still useful to someone who already has your name from another file, or to someone who wants to probe a brokerage helpdesk. It is not a full KYC dump.
Workforce: 35,255 people. Names, employee numbers, emails, mobiles, passwords. Seoul Economic Daily's "encrypted passwords" line is a reporter's gloss on the company. Encrypted is not the same as uncrackable, especially if the password was reused on webmail. Unique identifiers such as resident-registration numbers were not in the leaked staff set, the firm said. No financial damage had been confirmed at the time of the notice.
Who is affected?
A small slice of brokerage customers whose account numbers sat behind the phone-authentication login, and a large slice of the workforce including contractors and former employees. If you hold a Mirae Asset Life Insurance policy and not a Securities account, look at the Life Insurance catalog row instead. If you are a contractor who used mi-global, you may be in the 35,255 even if you never traded.
What should I do?
- Read the 7 November notice that applies to you, customer or staff. They are different letters.
- Customers: treat unexpected brokerage calls that already know your account number as hostile. Log in by typing the official site. The firm said names were not leaked with those numbers. A later update could add fields. Keep the letter.
- Staff and contractors: change the workplace password and any personal account that reused it. Turn on phishing-resistant MFA where the groupware offers it.
- Do not send a resident-registration number to anyone who claims to be "PIPC follow-up." The company said those numbers were not in this leak. Asking for them is the tell.
- Watch the Life Insurance sister-company notices as a separate file. One phishing kit will try to merge them.
The Chainalysis credentials update is a reminder that "passwords were hashed or encrypted" is not an all-clear if you reused the password.
Frequently asked questions
Is this the same as the Mirae Asset Life Insurance leak?
No. Life Insurance was indexed in October as a separate company and breach. This row is the brokerage.
Were customer names leaked?
The firm said no. The customer take is account numbers, about 3,800.
Were resident-registration numbers leaked?
The firm said unique identifiers such as resident-registration, passport and licence numbers were not leaked.
Did trading stop?
The firm said there was no service disruption and that major systems including the website kept running.
Why is the catalog count 39,055?
It is 3,800 plus 35,255. Those are different populations with different fields. The headline "39,000" is a sum, not a single file layout.
Sourcing note: counts and the two-system timeline come from Mirae Asset Securities notices as reported by Yonhap and Seoul Economic Daily on 7 November 2026. Encrypted-password wording is from Seoul Economic Daily's account of the staff file.