Bithumb says 844 customers' personal data leaked in groupware hack
Coinyong
An outsider accessed Bithumb's DaouOffice groupware for 59 minutes on Oct. 27 and took data and files.
Data on 844 of 6,444 affected customers was exposed; 5,600 records were encrypted. 715 staff were also hit.
Bithumb found no sign its exchange account or asset systems were breached and opened a leak lookup page.
South Korean crypto exchange Bithumb said personal data belonging to 844 customers was exposed in a breach of its internal mobile groupware system, with resident registration numbers and copies of ID cards among the leaked items. In a notice posted on its website on the afternoon of Oct. 29, Bithumb said it confirmed that an unauthorized outsider had accessed DaouOffice, its in-house mobile groupware, on Oct. 27 and taken personal data and files without permission. The company initially found that only employee data had been leaked, but further investigation showed customer data was also included.
A total of 6,444 customers were affected. Data for 5,600 of them was encrypted and could not be read, while data for the remaining 844 was exposed, the company said. Personal data of 715 employees and contractor staff was also taken.
A 59-minute window into the internal network
According to Bithumb, the unauthorized access lasted 59 minutes, from 11:28 a.m. to 12:27 p.m. KST on Oct. 27. The company detected the abnormal access at 12:14 p.m., blocked the access path and suspended use of DaouOffice. The exact cause of the intrusion is still under investigation, and an incident response task force is running security checks together with the groupware developer.
- Unauthorized outsider begins accessing the internal mobile groupware
- Bithumb detects the abnormal access, blocks the path and suspends the groupware
- Incident reported to the Korea Internet & Security Agency (KISA)
- Incident reported to the Personal Information Protection Commission
- Customer data breach notice and leak lookup page published
The leaked items include names, mobile phone numbers, email addresses, resident registration numbers, driver's license numbers, bank account numbers and copies of ID cards. The items exposed may differ from person to person. The 715 staff members comprise 646 Bithumb employees and 69 contractors and other outside workers, and all of them have been notified individually, the company said.
Separate from exchange accounts and coin balances
Bithumb said the breached groupware is an internal business system separate from customers' exchange accounts and asset information. It said there were no signs that the exchange's service systems or customer database had been directly breached, and that it is monitoring unusual trades and withdrawals in real time.
A day earlier, on Oct. 28, the Financial Services Commission (FSC) held an emergency meeting on security breaches in the crypto sector with the Financial Supervisory Service (FSS), the Financial Security Institute, the Digital Asset eXchange Alliance (DAXA) and Bithumb, among others. At the time, Bithumb reported signs that employee data had been leaked and said it was still checking whether user data was affected. The latest notice officially confirms that customer data was exposed. The FSC, FSS and Financial Security Institute have begun on-site inspections and said they will oversee consumer protection measures, including full compensation if any damage occurs.
"We will use this incident as an opportunity to review from scratch not only how we handle and store personal data, but our entire security management system, including internal systems."
Lee Jae-won, CEO of Bithumb
Warning over identity theft and staff impersonation
Bithumb warned that the leaked data could be used in financial fraud such as identity theft, voice phishing and impersonation of Bithumb staff. The company stressed that it never asks for passwords or verification codes by phone, text or messenger, nor sends links asking users to enter authentication details. Impersonation scams that use listings as bait can be reported through a separate reporting channel.
On compensation, Bithumb said it will take responsibility for all damage confirmed to have resulted from the leak and will provide relief and compensation in line with relevant laws and the nature of the damage. Affected people can also seek damages or apply for dispute mediation under South Korea's Personal Information Protection Act. The company said it will also undergo a security review by an outside specialist firm.
What Bithumb users should do
Users can check whether their data was leaked through the "personal data leak lookup" link in Bithumb's notice. Customers whose data was confirmed leaked will receive a text message detailing the exposed items and how to prevent and remedy damage. Users should not respond to anyone asking for passwords, verification codes or OTPs, or requesting OTP removal, remote-control app installation or a change of withdrawal address, and should review their two-factor authentication settings. Customers whose ID copies were leaked will receive separate guidance on reissuing IDs, reporting them lost and identity theft protection services. Inquiries can be made to the Bithumb customer center (1661-5566), the Personal Information Infringement Report Center (118) and the Personal Information Dispute Mediation Committee (1833-6972).
More crypto news
HYPE
BTC
ETH
BTC