October 26, 2026: Mirae Asset Life Insurance, a South Korean life insurer, said that hackers who attacked its website and apartment-subscription system had leaked customers' personal and credit information. The company has not said how many customers were affected. Canonical: mirae-asset-life2026. Primary source: Seoul Economic Daily's report of the company's statement.
Life insurers hold some of the most sensitive personal records in any financial business: identity details, contact information, health-related policy information and, in this case, credit information. Credit information is the element that makes the leak more than a phishing risk, because it can help a fraudster pass checks for loans or new accounts.
What happened
- October 25, 2026: irregularities surfaced on the company's website and apartment-subscription system.
- After analysis with an outside cybersecurity firm: the company confirmed that customer data had leaked. Reports differ on whether the leak happened on October 25 or in the early hours of October 26.
- Response: the company blocked the attacking IP addresses, took the website offline and reported the incident to the Financial Security Institute.
- October 26, 2026: the incident was reported publicly. The Financial Supervisory Service began an urgent on-site inspection covering the intrusion route, the scale of the exposure and any harm to consumers.
Technical analysis
The company has described the attack as a hacking attack on its website and its apartment-subscription system. The route the attackers used is under investigation, and the company has not published more detail. This article does not speculate on the method. The practical point for customers is the same either way: the data was taken from systems that customers used to apply for or manage products, so the leaked details can look like they came from a real application.
Verified vs unverified
- Verified (company statement, as reported): the October 25 irregularities, the confirmed leak of personal and credit information after outside analysis, the IP blocks, the website taken offline, and the report to the Financial Security Institute.
- Reported but not confirmed: one report says about 41 files were accessed. That figure is not in the company's statement and should be treated as unverified.
- Reported but not confirmed: one outlet links this incident to a wider run of attacks on 16 Korean financial institutions. The company has not made that link.
- Not disclosed: the number of customers affected, which fields were exposed, and how the attackers got in.
Who is at risk
Customers whose data was held in the website or apartment-subscription system are the most directly exposed. Credit information raises the risk for anyone in that group, because a fraudster can use it to make a loan application or account opening look routine. Because the company has not said how many customers were affected, the safest assumption for a customer is that their information may be included until the company says otherwise. The company has warned that the data could be used for identity theft, smishing and phishing. Customers who hold a policy but never used the apartment-subscription system should also watch for messages, because the company has not said which systems hold which fields.
What to do
- Treat calls or texts that mention your policy, a subscription or your credit as suspicious until you verify them through the insurer's official app or customer line, using a number you already have.
- Do not share one-time passcodes or identity numbers with anyone who contacts you first, even if they quote your policy or subscription details.
- Check your credit report for accounts or inquiries you do not recognise. Use your credit reporting provider's official site, not a link from a message.
- Be cautious with loan or refinancing offers that cite your personal details. A legitimate lender will not need you to send money or codes to complete an application. Check the lender through an official public register before you share anything.
- Be wary of links in text messages. The company itself has warned about smishing, which is phishing carried out by text message. If a message asks you to log in through a link, open the insurer's official app instead.
What the regulator is checking
The Financial Supervisory Service's urgent on-site inspection, as reported, covers three things: how the intruders got in, how much data was exposed, and whether customers have suffered harm. The answers will shape what the company tells customers, and the company's figures should be treated as provisional until the inspection reports.
Related reading
For a case where leaked personal details were followed by impersonation calls, see SBI's KYC data breach. For a case where account data was used to target customers at scale, see the Capcom ID leak. In both, the advice is the same: check any unexpected contact through a channel you already trust.