Data Breach at Two Online Investment Firms Affects 19,000 Customers

Customer information for approximately 19,000 individuals has been compromised at online investment firms PFCT and Mouda. According to a report received by Shin Dong-wook, a member of the National Assembly's Political Affairs Committee, from the Financial Supervisory Service, the data breach involved 18,900 customers from PFCT and 314 from Mouda. The exact extent of the damage may vary based on ongoing investigations.

PFCT experienced a hacking attack between 3:29 a.m. and 4:34 a.m. on September 27. This incident occurred approximately 19 hours and 50 minutes before the previously reported attack on Kookmin Bank, which took place at 11:19 p.m. on the same day. The attackers exploited a server-side template injection vulnerability to gain access to administrative functions, resulting in the leak of personal information, including resident registration numbers.

Mouda was also targeted on the same day at 11:54 a.m. The attackers used multiple IP addresses to exploit security vulnerabilities on the website. Mouda became aware of the incident the following day, September 28, at 7:06 p.m., and reported it to the Financial Supervisory Service on October 5 at 1:00 p.m.

So far, financial authorities have identified a total of 16 financial institutions affected by data breaches. The scale of personal information leaks includes 42,926 individuals from Egaram Savings Bank, 25,729 from Shinhan Bank, and 18,900 from Mouda, bringing the total number of affected individuals to approximately 100,000.