Mirae Asset Management confirmed that information was leaked after abnormal access by an unauthorised external party to some of its web systems.

On Oct. 28, Mirae Asset Management said it recently identified signs of abnormal access from external IP addresses on some web systems. It said it blocked related access routes and activated an emergency response system immediately after confirming the signs.

Mirae Asset Management reported the incident to the Financial Services Commission and the Financial Supervisory Service. It is conducting a detailed investigation into the cause and scope of impact with an external security firm.

So far, the investigation has found no signs of direct intrusion into servers or databases (DB). Major systems and services, including the company website, are operating normally, and no financial damage has occurred.

The leak is believed to be limited to information stored in some internal business systems. The company confirmed that unique identifiers and sensitive information, including resident registration numbers, passport numbers, driver’s licence numbers and foreign registration numbers, as well as personal credit information, were not leaked.

The system did not provide services to individual customers, so information on ordinary investors was not included among leaked data, the company explained.

The incident is believed to have involved viewing some materials from outside without proper access authority. No malware infection, system failure or service outage occurred.

Mirae Asset Management said that immediately after recognising the incident it used a web application firewall (WAF) to block overseas access and attacking IP addresses and temporarily suspended vulnerable functions. It applied limits on file downloads and the number of login requests, and addressed vulnerabilities identified during the access-rights verification process.

It deactivated accounts created from outside and took protective measures for potentially affected accounts, including guidance to change passwords as a precaution.

It plans to file a report to the Personal Information Protection Commission and provide individual notifications to data subjects within the deadlines set by relevant laws and regulations.

A Mirae Asset Management official said, "There was a data leak due to signs of abnormal access from external IPs in some of the company's systems, and we are blocking the access routes and conducting analysis." The official added, "It has been confirmed that the leaked information does not include unique identifiers or personal sensitive information."

The official said, "We completed security measures for the vulnerability as soon as we recognised the incident." The official added, "We plan to thoroughly analyse the cause with an external security firm and do our utmost to prevent recurrence."