Bithumb data breach illustration showing an unlocked padlock, exposed customer data records, and a cybersecurity threat in olive green, light green, and black.

Bithumb Data Breach Exposes 844 Customers as 6,444 Records Are Compromised

By /

key insights

  • The loss compromised the data for 844 customers and 5,600 others were still protected by encryption.
  • Differentiating internal application from trading systems can reduce the operational risk, but the sensitive files will still need to be well protected.
  • The incident adds pressure on South Korean financial institutions to improve internal security and incident disclosure procedures.

Bithumb data breach investigations have confirmed that an October 27 intrusion exposed personal information belonging to 844 customers and compromised records linked to 6,444 customers overall. The loss of data wasn’t limited to trading exchanges or cryptocurrency wallets as the second-largest exchange in South Korea also leaked info regarding 715 staff and external personnel.

Internal system intrusion reveals wider exposure

Bithumb reported the expanded scope of the incident on October 29 after a day of first announcing the internal system breach. The intruder got into DaouOffice, an office communications and file-sharing system that colleagues use in the workplace.

The hacking started at 11:28 a.m. local time on October 27, according to the exchange. Bithumb detected suspicious activity at 12:14 p.m. and started restricting access before shutting down the affected system.

The intrusion lasted approximately one hour, during which the attacker copied files containing customer information. Investigators later established that the stolen files included records associated with 6,444 customers.

Bithumb initially reported compromised information involving 715 people, including 646 employees and 69 contractors. The internal platform, however, contained customer records in files, to which more investigations were done. The findings expanded the incident from an employee information leak into a broader customer privacy concern.

Exposed records include sensitive personal information

Bithumb said 5,600 customer records remained encrypted when the attacker obtained them. The other 844 records contained directly exposed personal information, although the specific details varied among affected individuals.

The compromised information included names, mobile phone numbers, email addresses, resident registration numbers, driver’s license numbers, bank account numbers, and identification document copies.

The following figures summarize the confirmed scope of the incident:

  • 6,444 customers had information in files that was being accessed during the intrusion.
  • Bithumb reports that 5,600 records were still encrypted.
  • In total, there were 844 customers where personal information was directly exposed.
  • Information was also stolen from 715 employees and outsiders.

There is a difference between encrypted and exposed records, and the available info doesn’t indicate that attackers would have been able to access all of the records they have stolen. But password-based encryption won’t solve the problem of potential misuse or whether the information involved is still protected.

Bithumb said that hackers may use the leaked data to commit identity theft, voice phishing, and impersonation fraud. This means that customers could be at risk even if they don’t have any proof of unauthorized access to their exchange accounts.

Trading infrastructure remains separate

Bithumb stated that DaouOffice operates separately from its core trading systems, customer account database, and asset-holding information. The exchange said there was no proof that attackers broke into those systems during the incident.

This separation keeps the confirmed damage, from the breach limited but it does not eliminate the dangers that come with personal information being exposed. Employees had transferred customer information into internal work files, creating another location where sensitive data could be accessed.

The incident therefore is an exposure of a security vulnerability in the exchange that is not necessarily related to the trading platform itself. Corporate messaging and file-sharing apps can also turn into extra exposure points when workers’ file sharing sensitive customer data outside of the systems. 

Bithumb blocked the suspected access route, suspended the affected application, and cooperated with the developer of the application, Daou Technology, to investigate and solve vulnerabilities.

It further informed the concerned authorities and appealed to customers to lodge complaints regarding the damage in its customer service channels.

Financial sector breaches raise wider concerns

The Bithumb data breach comes amid a broader series of cybersecurity incidents affecting South Korea’s financial sector. Financial authorities previously reported breaches at 16 financial companies, with approximately 100,000 cases of personal information leakage identified at that stage.

Four more companies, including Bithumb, were later impacted to result in a cumulative 20 affected companies. In other investigations, too, higher numbers of victims have been found than those reported by companies.

In the case of KB Kookmin Bank, for instance, the number of affected people was revised up after further inspection from 119 to 2,210. The cases are illustrative of how disclosures can be incomplete and need to be supplemented to even reflect the extent of a violation.

A concurrent hack at another cryptocurrency exchange, Pravang, saw the theft of some 100 million Korean won worth of virtual currency. As in that case, it shows the difference between information exposure and actual asset theft. Unlike confirmed losses from trading accounts, the instant issue that Bithumb is facing is that of privacy, fraud prevention, and customer trust.

Conclusion

Bithumb has pledged to compensate customers for verified damages resulting from the information leak. Chief Executive Lee Jae-won also apologized and promised a comprehensive review of the company’s internal security infrastructure.

The exchange has asked customers to ignore suspicious requests for verification codes or installation of the application from the person claiming to be from Bithumb. It is recommended that customers check communications with official channels instead.

The results of the investigation will highlight the need for sensitive information to be managed in all systems of business. To determine if exposed records caused additional damage and to show that its remediation efforts rectify the vulnerabilities is next up for Bithumb.

Related Posts

Scroll to Top