Wave of breaches hits South Korean brokerage, prompting government audit of private sector systems

Cyber attacks in East Asia have moved beyond the walls of traditional banks to strike brokerage and asset-management firms. As South Korean financial institutions record a new wave of breaches, AI-powered hacking tools have emerged as a direct threat to the private financial sector. The latest incidents involve the brokerage firm Daishin Securities, the global investment manager Mirae Asset Global Investments, and the cryptocurrency exchange Bithumb. These events follow roughly a month after a similar series of attacks hit South Korea’s financial sector in September, widening regulatory concern over the fragility of defenses outside the large banking system.

The Daishin breach exposed data of 38,490 clients, recalling the Artex tool.The Korean firm announced a security breach affecting the names, email addresses and mobile phone numbers of thousands of clients, notifying those affected, beginning cooperation with official investigators and pledging legal compensation for any financial losses arising from the incident as required by law. In contrast, Mirae Asset and Bithumb reported separate security incidents on Wednesday, without confirming any client data exfiltration to date. These blows carry exceptional sensitivity because cybersecurity researchers linked the September attack wave against South Korea to a hacker suspected of originating from China, who used an AI-enabled penetration-testing tool called Artex, while investigators continue to examine the root causes of the recent breaches to determine their connection to the same tool.

Facing repeated targeting, South Korea’s Financial Services Commission called for tighter cyber-security measures after attacks on financial institutions and government agencies, and Seoul announced its intent to conduct examinations and security audits covering dozens of private-sector technology systems. Korea was not isolated in this tense regional landscape; Japan also reported a security incident affecting GMO Internet following successive attacks on its financial subsidiaries. Experts attribute this scattered wave of challenges across Asia to years of underinvestment in digital infrastructure protection, and although investigators have not yet proven a direct link between the incidents, their simultaneity confirms that offensive technologies have become a cross-border pathway that can be replicated in any promising market.

Automated scanning tools reduce the attacker’s cost and increase defense burdens in regional markets.This on-the-ground shift in Asia puts technology and compliance leaders at Gulf banks and brokerage platforms in Egypt and the Levant on a real warning bell. Financial markets in Riyadh, Abu Dhabi and Dubai are experiencing a broad surge in the launch of digital trading platforms, managed investment funds and firms licensed to trade cryptocurrencies, environments that naturally prioritize rapid user order fulfillment while their peripheral defenses remain less resilient than the core infrastructure of major banks. Deploying AI tools such as Artex in reconnaissance and vulnerability-discovery stages gives attackers an exceptional ability to scan application code and examine APIs of dozens of institutions in parallel at low cost, bypassing the need for costly traditional command centers.

We have tracked the path of these attacks and see that traditional solutions based on periodic security reviews are now unable to protect regional investment and technology firms. If you lead information security or digital transformation at a bank or private financial company, the immediate step requires AI-enhanced attack simulations through continuous, connected testing of API layers, partner servers and external service providers. What happened in Seoul makes clear that financial-regulatory audits will no longer stop at major banks, but will soon extend to private brokerage and fintech firms that now represent the soft underbelly of money flows and personal investor data.