Finance

Attackers used a fake regulator account to breach Korea's Financial Security Institute assessment system, taking files from 48 financial firms

KBS and Yonhap report that the information protection assessment support system of Korea's Financial Security Institute was hacked on November 9, 2026; the institute confirmed some data leaked, blocked the system and reported to the Financial Services Commission, and files from about 48 financial firms, some 130 in total, are estimated to have leaked .

NTT Data announced on Nov 9 that the sign-up service for Sumitomo Life's standalone Vitality programs, which it builds and operates under contract, was accessed by a third party and personal data of about 80,000 users leaked .

BleepingComputer reports that a threat actor using the ShinyHunters handle, believed to be impersonating the extortion gang, is selling what they claim are records of 335 million Binance users on a new underground forum and asking $900,000 .

The Hacker News reports that some Keplr crypto wallets set up with Google or Apple accounts had funds stolen by an attacker who used a security flaw at Web3Auth, the company running that sign-in .

The Hacker News reports that LNbits, an open-source Bitcoin Lightning wallet system, told all operators on Nov 8 to shut down their servers immediately because of a wave of attacks, saying several security fixes are pending .

Mirae Asset Securities announced that its internal groupware system, mi-global, suffered an external attack on November 5, leaking personal data of approximately 35,255 employees, including former and outsourced personnel .

According to The Record, cybersecurity media reported in November 2026 that blockchain analytics firm Chainalysis experienced a security breach .

MS&AD group insurers Mitsui Sumitomo Insurance and Aioi Nissay Dowa said on Nov 6 that unauthorized access to their policyholder portal was detected on the night of Nov 2, related services were halted late on Nov 3, and the investigation confirmed a data leak .

Acronis TRU disclosed on Nov 4 an attack framework called BOSSAI that combined 12 AI agents, targeted organizations in 11 countries over 12 observed days, and was assessed to be run by an individual in Hualien City, Taiwan .

French cooperative banking group Crédit Mutuel Arkéa announced on November 4, 2026, that it had suffered a cyberattack enabling attackers to execute fraudulent transactions, prompting the bank to suspend certain operations to prevent further fraudulent fund movements .

Bank SinoPac experienced unauthorized customer account transfers on November 3 and held a press conference on November 4 confirming that external hackers had exploited a security configuration flaw in a new online banking transaction system provided by a third-party vendor .

Website performance monitoring firm DebugBear said an unauthorized third party gained access to its domain registrar account and replaced its monitoring script with malicious code for about two hours, in what it assesses was a targeted, financially motivated attack on one customer website .

According to CNBC, crypto exchange Binance said a security incident affected about $6.

Mirae Asset Life said it detected anomalies in some systems on October 25, 2026, recognised a cyber intrusion, and confirmed a personal data leak early on October 26 after analysis with an outside firm .

GMO Internet said that on October 20 it confirmed a third party had planted a malicious program on some customer servers of its Onamae.

Switzerland's FDPIC said PK Softech AG reported a cyberattack on its IT infrastructure on October 8, with data extracted from several pension funds including the federal pension fund Publica, and it opened a formal investigation on October 22 .

Hana Bank said an illegal intrusion into its sales support system on September 30, 2026 led to the leak of information on 89 customers, confirmed on October 2 .

Crypto exchange Bitget confirmed that, based on the latest on-chain tracing, about $387.

According to TNW, DriveWealth, the US broker behind US stock trading in Revolut and other apps, said an unauthorized party entered its network on September 4 and 5 through social engineering, and platforms such as Stake and Hatch have notified customers .

According to manager magazin, Revolut answered a fraudulent information request sent from a legitimate government agency email domain, handing ID copies, account numbers and home addresses of at least 700 customers to criminals, who are now demanding ransom .