Bithumb Confirms a Groupware Breach as Daishin Counts 38,490

Bithumb said an outsider reached the internal mobile groupware system its employees use for work and messaging, and that personal information leaked out of it. South Korea's second-largest exchange by trading volume found the intrusion on Tuesday. It says the system sits apart from the trading platform, so customer coins were never within reach of whoever got in. Two Seoul securities firms disclosed incidents of their own within hours, and the Financial Supervisory Service said on Wednesday that it was assessing three financial companies, Bithumb among them.

Where the exchange draws the line

The sentence Bithumb keeps repeating is about access, not about what left.

Bithumb said "customer virtual assets cannot be accessed through this breach," in wording carried by CoinDesk early on Wednesday.

No funds had been reported lost as of the Asian afternoon, on CoinDesk's account and on Bitcoin.com's. The exchange has not said how many people the leak touched, and it has not said whether deposits or withdrawals were affected at any point. The Korea Times, which has tracked the wave of intrusions at Korean financial firms since late September, reported that the data known so far concerns employees and that customer exposure is still being checked. CoinDesk says personal information was taken and separates nothing. We could not establish whether a single member record is among the leaked files. Bithumb told Yonhap it was analysing the scope, "including the possibility of member information being involved", which is a long way from a count.

Daishin put a number on its own

Daishin Securities did what Bithumb has not. Personal and credit information for 38,490 customers was compromised in an outside attack, the brokerage said on Wednesday, and all three accounts read here carry that figure without dispute. The Korea Times, alone among them, describes how the firm arrived at it: suspicious access on 17 October to a server supporting online account openings, attacking addresses blocked, then a review of more than 60,000 signals disguised as ordinary service requests before the leak was confirmed. By that telling the exposed fields ran to names, email and home addresses, login IDs, bank names, account numbers and mobile numbers, with the account and mobile numbers encrypted. Mirae Asset Global Investments, the third firm, says it blocked abnormal access to some web systems and that investor information was untouched. Bitcoin.com reports that investigators have not tied the Bithumb intrusion to either of the others, and no account read here contradicts that.

The count the regulator is keeping

A running tally exists, and it depends on who is counting. Earlier this month the FSS governor said cyberattacks had reached 16 South Korean financial firms as of 14 October, on CoinDesk's reading. The Korea Times gives the same date and the same 16, attributes it to the FSC and the FSS together, adds about 100,000 records, and then puts the number of publicly identified firms at 20. The two figures count different things on different days and they do not reconcile into one current total. Both are still moving. This is the same supervisor that spent October tightening the perimeter around trading itself, blocking 27 unregistered exchange websites for serving Korean users without registering.

What the exchange still has to answer

Scope is the open question, and only Bithumb can close it. Until the analysis finishes, nobody outside the company knows whether the leaked records are staff files, member files or both, and the exchange's assurance covers assets rather than data. Korean rules give it little room to sit on the answer: the incident has been reported to the Korea Internet and Security Agency and the Personal Information Protection Commission, by The Korea Times's account, and both bodies expect notification of affected individuals. Breaches of this shape have a way of growing after the first statement, as they did when a fintech's attackers went public with 680 customer files and a ransom demand. Bithumb's February error, when it credited users with 620,000 BTC instead of 620,000 won, was fixed inside its own ledger. A leak cannot be clawed back the same way.