Daishin. The way in was not Daishin's trading apps or website. It was an integration server that lets outside investment advisory and discretionary management firms open Daishin accounts for their own clients through their apps. Daishin spotted abnormal access on Oct 17, blocked the attacker's IP addresses, and with Korea's Financial Security Institute reviewed about 60,000 requests disguised as normal traffic over 10 days. On Oct 26 it confirmed eight data fields were taken: names, email and postal addresses, telecom IDs, bank names, deposit and withdrawal account numbers, Daishin account numbers and mobile numbers. The account and phone numbers were encrypted. Daishin says its core systems were not reached, it has seen no follow-on fraud so far, and it will compensate customers who lose money.
Mirae Asset and Bithumb. Mirae Asset Global Investments said attackers got into some of its web systems and exposed information from internal business systems, but its early findings show no sensitive personal, credit or investor data taken. Its affiliate Mirae Asset Life Insurance confirmed a customer data breach earlier this week. Bithumb said someone broke into its employee mobile groupware, which runs on the third-party platform Daou Office. The system is separate from trading, so customer assets are safe, but Bithumb can't yet rule out that member data was exposed. Investigators have not linked these breaches to each other or to last month's wave, and Daishin says it is still checking whether AI tools were used.
What I'd do today. Two of these three came in through side doors: a partner-facing account-opening server and a third-party staff app. List every server that exists so partners or vendors can plug into you, and treat each like a front door: put it behind its own login checks, watch it for odd request volume, and make sure it can only reach the data it truly needs. Daishin needed 10 days to dig through 60,000 fake-normal requests, so keep detailed logs on those integration points before you need them.