Bithumb says hack of in-house mobile system leaked personal data
In short
Crypto exchange Bithumb said on 28 October that an unauthorised outside party accessed its in-house mobile groupware system and personal data was leaked. The company said it noticed the leak the day before and reported it to KISA and the Personal Information Protection Commission that day. It is still analysing the scope, including whether member information is affected.
Read the full story 2 min read
Bithumb, a crypto exchange, said on 28 October that personal data was leaked after an unauthorised external party abnormally accessed its in-house mobile groupware system. Yonhap and other outlets reported that the company recognised the leak on 27 October and told the Korea Internet and Security Agency (KISA) and the Personal Information Protection Commission about the breach the same day. [ 1 , 5 , 10 , 19 , 21 ]
Bithumb said it is analysing the exact scope, including the possibility that member information is included. Electronic Times reported that the company is investigating the type and scale of the leaked data and that data of general members, not only employees, may have been leaked. Newsis reported that Bithumb blocked the access right after it recognised the incident and quoted the company as saying it was moving quickly on the exact scope and items and would inform customers through its website that morning. [ 5 , 10 , 11 , 14 , 17 ]
Seoul Shinmun described groupware as an internal system where employees handle work and share information. A Korea Economic Daily headline, with no article text available, quoted Bithumb as saying its in-house messenger 'Daou Office (다우오피스)' was hacked and there was no sign of access to customer assets. Chosun Ilbo reported that personal data of 646 employees was leaked on 27 October and that the company was checking whether content exchanged on the in-house messenger included customer personal data. [ 5 , 15 , 18 ]
Outlets placed the case within a run of incidents. Chosun Ilbo reported that Daishin Securities confirmed a leak of 38,490 customers' data and that a hacking incident also occurred at Mirae Asset Global Investments, with financial authorities checking the cause and scale. Kyunghyang Shinmun said security incidents had earlier been reported at Streami (스트리미), operator of Gopax (고팍스), and at Prabaeng (프라뱅), a coin market exchange. Newsis called the Bithumb case an extension of chain cyberattacks spreading across the financial sector. [ 14 , 15 , 21 ]
Chosun Ilbo also quoted Lee Chan-jin, head of the Financial Supervisory Service, who said AI-assisted hacking methods are becoming more sophisticated and urged financial firms to invest more in security. [ 15 ]
On 29 October, a Yonhap item headlined that Bithumb's customer data leak was confirmed belatedly said customer personal data was also reportedly leaked in the in-house system hack. Only the summary was available, with no further detail. [ 24 ]
Why it matters
Outlets placed the incident within a run of hacking cases hitting financial firms, including Daishin Securities and Mirae Asset Global Investments. Whether customer data is involved is not settled in the early reports, so the scale is still open.
Key facts
- Bithumb said an unauthorised external party accessed its in-house mobile groupware system abnormally, and personal data leaked. [ 1 , 5 , 10 , 17 , 19 ]
- The company said it recognised the leak on 27 October and reported the breach to KISA and the Personal Information Protection Commission the same day. [ 1 , 5 , 10 , 19 , 21 ]
- Bithumb said it is analysing the exact scope of the leak, including the possibility that member information is included. [ 5 , 10 , 17 , 19 , 21 ]
- Chosun Ilbo reported that personal data of 646 employees was leaked on 27 October. [ 15 ]
- Newsis quoted Bithumb as saying it planned to inform customers officially through its website that morning. [ 14 ]
- Yonhap reported on 29 October that customer personal data was also reportedly leaked. [ 24 ]
Confirmed by several sources
- Bithumb said personal data was leaked after an unauthorised external party abnormally accessed its in-house mobile groupware system. [ 1 , 5 , 10 , 17 , 19 , 21 ]
- Bithumb reported the breach to KISA and the Personal Information Protection Commission on the day it recognised it. [ 1 , 5 , 10 , 19 , 21 ]
- Bithumb is analysing the exact leak scope, including whether member information is included. [ 5 , 10 , 17 , 19 , 21 ]
Still unclear
- Whether customer personal data was leaked. Reports on 28 October said the company was still analysing whether member information was included; a Yonhap summary on 29 October said customer data was reportedly also leaked, without detail.
- How many people are affected. Only Chosun Ilbo gives a figure (646 employees); the other outlets say the type and scale are still being investigated.
- Whether customer assets were accessed. Only a Korea Economic Daily headline says Bithumb reported no sign of access to customer assets; the text was not available.
- When the attack happened. Seoul Shinmun, Maeil Business and Chosun Ilbo say it is presumed to have happened on 27 October, while Newsis says the company detected it 'recently'.
What local media are saying
Timeline, local time
- Yonhap flashed that Bithumb said its in-house mobile system was hacked and personal data leaked. [ 1 , 2 ]
- Newsis reported that Bithumb said it would inform customers through its website that morning. [ 14 ]
- Chosun Ilbo reported that 646 Bithumb employees' data was leaked on 27 October. [ 15 ]
- Korea Economic Daily headline: Bithumb says messenger 'Daou Office (다우오피스)' hacked, no sign of access to customer assets. [ 18 ]
- On 29 October, Yonhap reported that customer personal data was also reportedly leaked from the in-house system hack. [ 24 ]