ARTEX Intel中文

Timeline

Follow-on intrusions in Korea's financial sector (cumulative 37 institutions, 40 incidents)

Event date2026-10-17 to 2026-11-03
Disclosed2026-11-05
TypeData theft / theft of funds
ConfidenceConfirmed
ARTEX statusARTEX not named
Countries and regionsSouth Korea
SectorsSecurities, Insurance, Asset management, Crypto assets, P2P

The Financial Services Commission (FSC) said on Nov 5 that from Sep 30 to Nov 3 there were intrusion reports from 37 institutions covering 40 incidents and about 473,000 records, and that some small institutions had about KRW 1 billion of self-managed funds stolen. The list was not published. 22 institutions have been publicly named. Many were entered through groupware or external connection points. As of Nov 6 there is no public report of a final penalty or an arrest in the financial cases.

Confirmed victims

  • Mirae Asset Life Insurance
  • Daishin Securities
  • Mirae Asset Global Investments
  • Bithumb
  • Hanyang Securities
  • Zoomfund
  • Pravang (second incident)

Targets

  • Energy Infra Asset Management (attempted, no leak confirmed)

Attribution

ARTEX basis
None of the sources read applies ARTEX to these institutions. Yonhap said on Nov 1 that the October incidents cannot all be attributed to the same attacker or the same AI tool.
Actor
Not determined.
Same attacker?
Yonhap, Oct 28: whether it is the same attacker has not been determined.

Figures and definitions

Institutions37 institutions, 40 incidents (FSC, Nov 5, as of Nov 3)
Institutions (media)20 (Oct 28); 22 (CBS NoCut, Nov 4, own count)
LeakedAbout 473,000 records (a count of records, not people)
Stolen fundsAbout KRW 1 billion (FSC); Pravang about KRW 100 million, Zoomfund KRW 300 million (media)
BithumbSeveral hundred records; about 800; 7,155; 7,159 (different times and sources)
Daishin38,490 people

Related events

Sources (14)