ENKR

Bithumb staff groupware breach

Add to my breach check

Made public

What leaked7

Hard to replace

  • ID card image
  • Driver's licence number
  • Bank account number
  • Mobile number
  • Email address

Permanent

  • Resident registration number
  • Full name
  • ID card imageitems vary by customer · 844 customers; 715 staff also affected
  • Resident registration numberitems vary by customer · 844 customers; 715 staff also affected
  • Driver's licence numberitems vary by customer · 844 customers; 715 staff also affected
  • Bank account numberitems vary by customer · 844 customers; 715 staff also affected
  • Mobile numberitems vary by customer · 844 customers; 715 staff also affected
  • Email addressitems vary by customer · 844 customers; 715 staff also affected
  • Full nameitems vary by customer · 844 customers; 715 staff also affected

To-dos8 · about 1 h in all

  1. Block new loans and cards in your nameabout 10 minStops: loans or cards in your name · Limits harm from: scam calls (opens in a new tab)
  2. Block non-face-to-face account opening in your nameabout 10 minStops: bank account in your name · Limits harm from: scam calls (opens in a new tab)
  3. Register as an exposed person with the FSSabout 10 minLimits harm from: scam calls, loans or cards in your name, bank account in your name (opens in a new tab)
  4. Know the scam pattern: calls and texts that cite these leaked detailsabout 5 minfreeLimits harm from: scam calls, phishing messages
  5. Check your credit records and block status on credit4uabout 10 minfreeHelps you notice: loans or cards in your name (opens in a new tab)
3 more
  1. Block new mobile lines in your name with Msaferabout 10 minfreeStops: phone line in your name (opens in a new tab)
  2. Report the lost resident ID card on Gov24about 5 minLimits harm from: bank account in your name, phone line in your name (opens in a new tab)
  3. Check every phone line in your name on Msaferabout 5 minfreeHelps you notice: phone line in your name (opens in a new tab)

What happened next12 events

  1. UndetectedNone on record
  2. Response 9 eventsNo individual notice on record · show events
  3. Remedy 1 eventOngoing · show events
  4. Penalty 2 eventsOngoing · show events
  5. DisputesNone on record
  1. The CEO issued a separate apology for the customer data leak
  2. Leak notice on the website: data of 6,444 customers (844 confirmed, 5,600 in encrypted form) and 715 staff and partner staff taken from the staff mobile groupware
  3. Reported to the PIPC at 00:48 KST on 28 October; KISA had been told at 23:39 KST on 27 October
  4. FSC emergency meeting: Bithumb reported signs that data of staff at Bithumb, its subsidiaries and partner firms leaked; user data still being checked
  5. Reported the breach to KISA and the PIPC on the day it was found
7 more
  1. Access path blocked and the staff groupware taken out of use after the abnormal access was noticed at 12:14 KST
  2. Abnormal access by an unauthorised outsider to the staff mobile groupware found, with personal data leaked
  3. Incident task force set up with the groupware developer; real-time monitoring of unusual trades and withdrawals strengthened
  4. Said it would provide relief and compensation under the law where damage from the leak is confirmed
  5. Dedicated damage counselling line opened
  6. Customers can check on the website whether their data leaked
  7. FSC, FSS and Financial Security Institute began on-site investigations
Company
Bithumb
Company detected it
Made public
Notice
Leak confirmed

How the facts developed

  1. Bithumb's statement (reported by the press on October 29, 2026): names, mobile numbers, email addresses, resident registration numbers, driver's licence numbers, account numbers and ID card copies of 844 customers leaked, with different items for each customer
  2. FSC release: Bithumb reported signs that data of employees of Bithumb, its subsidiaries and partner firms leaked after abnormal outside access to a system that supports staff work; whether user data leaked is still being checked, and no leak of wallet addresses or other data usable for unauthorised payments or crypto transfers has been found so far

Sources