Bithumb, South Korea’s second-largest cryptocurrency exchange, said personal data was exposed after an outside attacker got into its internal mobile office system. News1 said the exchange spotted unusual access on Oct. 27 and informed the Korea Internet & Security Agency (KISA) and the Personal Information Protection Commission that same day.
Bithumb told local media that the information confirmed as leaked so far mostly involves employee data. It is still checking whether member data was exposed too. And as of 11 a.m. Taiwan time on Oct. 28, there was still no related notice on the exchange’s official announcement page.
DaouOffice system used by employees was compromised
The breached platform was a mobile work collaboration system used by employees, including internal messaging and schedule management. General customers did not use it.
According to information News1 obtained, the affected system was DaouOffice, a collaboration product made by South Korean software company Daou Technology. Dealsite said Daou Technology operates the system on Bithumb’s behalf.
A Bithumb official told Mydaily, "The personal information leak we have identified so far involves employee data, but member data may also be included, and we are confirming the exact scope of the leak and the scale of the damage." The company is still trying to pin down the full scope of the leak and how many parties were affected. Digital Today said the number of affected people, the kinds of data exposed, the attacker’s identity, and the route of intrusion are all still being investigated.
Bithumb says customer asset systems are physically separated
Even so, because the system was used only by employees, Bithumb is reviewing conversations and files shared through the internal communication tool to see whether customer data was included. A company official told News1, "Although it is communication software used only by employees, customer data may have been included when files were shared, so we are checking that separately."
On customer assets, a Bithumb official told Dealsite that the company’s internal mobile collaboration system is physically separated at the network level from systems connected to exchange trading and customer assets. The official also said the company is identifying affected parties and the size of the incident, and it will disclose more when the investigation reaches a clearer stage. Bithumb also told TechM it has not found signs of unusual access to customer assets.
Other South Korean financial firms also reported cyber incidents
SBS reported that South Korea’s Financial Supervisory Service on Oct. 28 was also handling breaches involving Mirae Asset Global Investments and Daishin Securities, along with Bithumb.
Daishin Securities said in a press release issued that morning that personal and credit data belonging to 38,490 customers had been leaked. The Financial Supervisory Service sent an on-site inspection team.
Mirae Asset Global Investments said some of its network systems showed unusual access from external IP addresses and that the access route had been blocked. The company said it had not found any leak of identification data, sensitive data, or personal credit data. Before that, Mirae Asset Life had confirmed an intrusion incident on Oct. 26.
Smaller exchanges had also disclosed personal data leaks earlier this month
News1 said smaller exchange GOPAX announced on Oct. 16 that personal data belonging to seven customers and two former and current employees had been leaked. Another small exchange said on Oct. 9 that it had suffered outside access on Oct. 2, exposing personal data linked to about 20 customers.
At a regular meeting with the chairmen of eight banking and financial holding company boards on Oct. 28, the head of South Korea’s Financial Supervisory Service urged the industry to tighten information security. He said, "Once AI is used as a hacking tool, security vulnerabilities become easier to find, and simultaneous attacks on multiple points will become the norm."