Daishin Securities data breach: 38,490 customers' personal data leaked
Synopsis
South Korea's cybersecurity crisis deepened on 28 October as Daishin Securities disclosed a breach exposing 38,490 customers' personal data — the latest in a wave of attacks that has hit 16 commercial banks this year. With AI-detected PHP flaws now threatening global web infrastructure and Seoul raising its cyber alert level, the country is scrambling to patch systemic vulnerabilities before attackers exploit what are being called the most severe AI-discovered security flaws on record.
Key Takeaways
Daishin Securities confirmed on 28 October 2026 that 38,490 customers' names, email addresses, and mobile phone numbers were leaked following a hacker intrusion.
South Korea's Ministry of Science and ICT has ordered security inspections of approximately 170 key IT infrastructures , covering 111 public organisations , to be completed by end-2026 .
A total of 16 commercial banks in South Korea reported cyberattacks and customer data breaches earlier this year.
The national cyber crisis warning level was raised to 'caution' — the second lowest in a four-tier system — over critical PHP programming language vulnerabilities.
President Lee Jae Myung has called for cybersecurity methods suited to the AI era as exploit codes for the PHP flaws are already publicly available.
Cybersecurity firm Wiz described the PHP vulnerabilities as the 'most severe' ever detected using artificial intelligence.
Daishin Securities, a major South Korean brokerage, confirmed on Wednesday, 28 October 2026 that the personal data of 38,490 customers had been compromised following unauthorised access by hackers detected the previous week. The leaked information includes names, email addresses, and mobile phone numbers, marking one of the more significant data breaches to hit South Korea's financial sector this year.
What Was Leaked and How
The brokerage said it detected signs of intrusion last week and, upon investigation, confirmed that sensitive customer records had been exfiltrated. The breach covers personally identifiable information — names, email IDs, and phone numbers — that could potentially be used for phishing or targeted fraud. Daishin Securities has not yet publicly disclosed how long the attackers had access before detection.
South Korea's Escalating Cybersecurity Crisis
The Daishin Securities breach does not stand alone. A total of 16 commercial banks in South Korea reported cyberattacks leading to customer data breaches earlier this year, signalling a systemic pattern of vulnerabilities across the country's financial infrastructure. The incidents have prompted a sharp policy response from Seoul.
The Ministry of Science and ICT has now announced large-scale vulnerability inspections targeting approximately 170 key IT infrastructures in the private sector. Of these, 111 public organisations managing critical systems — particularly those with internet-facing assets such as web servers and public portals — will undergo a dedicated security assessment. All inspections are expected to conclude by the end of 2026.
PHP Vulnerabilities Raise Global Alarm
Compounding the domestic crisis, South Korea's science ministry raised the national cyber crisis warning level to 'caution' — the second lowest in its four-tier system — as the country joined global efforts to address two critical security flaws in PHP, the programming language that underpins a substantial portion of the world's websites. The warning took effect as of noon on the same day.
Companies and government agencies were directed to apply patches immediately. Science Minister Bae Kyung-hoon warned in an official release: 'The flaw found in PHP could affect a number of websites and requires an urgent response as exploit codes have already been made publicly available.' Cybersecurity firm Wiz — among the researchers who uncovered the PHP flaws — described them as the 'most severe' vulnerabilities ever detected using artificial intelligence.
Presidential Concern and the AI Dimension
South Korean President Lee Jae Myung has expressed concern over the rising wave of cyberattacks, calling on the country to develop cybersecurity frameworks suited to the AI era. The PHP vulnerabilities themselves were reportedly identified through AI-assisted analysis — a development that underscores how artificial intelligence is increasingly shaping both the offence and defence sides of cybersecurity. The global disclosure of these flaws prompted government agencies and companies worldwide to shut down websites as a precautionary measure.
What Comes Next
With the vulnerability inspections underway and patch directives in effect, authorities are expected to publish interim findings before year-end. For affected Daishin Securities customers, the brokerage has yet to detail its notification and remediation plan. Regulatory scrutiny on South Korea's financial-sector cybersecurity posture is set to intensify in the weeks ahead.
Point of View
Not an isolated incident — sixteen South Korean commercial banks reported breaches earlier this year, pointing to a structural deficit in the country's financial-sector cyber defences. What is notable is the convergence of threats: domestic intrusions and globally disclosed PHP vulnerabilities landing simultaneously, testing both policy response speed and institutional readiness. Seoul's decision to raise the alert level and order inspections of 170 infrastructures is reactive rather than pre-emptive, and the real question is whether the end-of-year deadline for assessments is fast enough given that exploit codes are already in the wild. President Lee's call for AI-era cybersecurity frameworks is directionally right, but frameworks take years to operationalise — the patch window on these PHP flaws is measured in days.
NationPress
28 Oct 2026
Frequently Asked Questions
What happened in the Daishin Securities data breach?
Daishin Securities confirmed on 28 October 2026 that hackers gained unauthorised access to its systems and exfiltrated personal data belonging to 38,490 customers, including their names, email addresses, and mobile phone numbers. The brokerage detected signs of the intrusion the previous week.
How serious is South Korea's cybersecurity situation in 2026?
It is regarded as a systemic crisis: 16 commercial banks already reported cyberattacks and customer data breaches earlier in 2026, and now a major brokerage has joined the list. The government has responded by ordering inspections of around 170 critical IT infrastructures and raising the national cyber alert level.
What are the PHP vulnerabilities that triggered South Korea's cyber alert?
Two critical security flaws were discovered in PHP — a programming language that powers a large proportion of the world's websites — and were identified using artificial intelligence. Cybersecurity firm Wiz, among the researchers who found them, described them as the 'most severe' vulnerabilities ever detected by AI, and exploit codes are already publicly available.
What is South Korea's government doing in response to the cyberattacks?
The Ministry of Science and ICT has launched vulnerability inspections targeting around 170 key IT infrastructures, with a focus on 111 public organisations managing internet-facing systems. Inspections are expected to conclude by end-2026, and companies have been directed to patch PHP vulnerabilities urgently.
What should Daishin Securities customers do following the breach?
Affected customers — whose names, email addresses, and phone numbers were exposed — should be alert to phishing emails or suspicious calls using their personal details. The brokerage has not yet publicly detailed its customer notification or remediation plan, so customers are advised to monitor official communications from the firm.
