# Bithumb internal groupware hacked, employee data leaked · pwn.watch > South Korean crypto exchange Bithumb detected unauthorized access by an outside party to its internal mobile groupware system on Oct 27 2026, leading to a personal data leak, and reported it to KISA and the Personal Information Protection Commission the same day. Information found so far mainly concerns employees, such as names, departments and contact details, but Bithumb has not ruled out that customer information shared in internal work files was included and is still analyzing the scope. Bithumb says its exchange systems are physically separated from the groupware and no crypto was stolen. Daishin Securities and Mirae Asset Global Investments reported separate breaches the same day. Page: https://pwn.watch/i/bithumb-groupware-breach-oct-2026 · generated 2026-10-28T05:44:34.569Z ## Status - Severity: medium · status: live · patch: partial - Product: Bithumb internal mobile groupware (employee and possibly customer data) - Started: 2026-10-27 ## Follow this incident - RSS (one item per update): https://pwn.watch/i/bithumb-groupware-breach-oct-2026/feed.xml - JSON Feed: https://pwn.watch/i/bithumb-groupware-breach-oct-2026/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/bithumb-groupware-breach-oct-2026.json - This file: https://pwn.watch/i/bithumb-groupware-breach-oct-2026/llms.txt ## Updates (newest first) - 2026-10-28: Bithumb says the leaked data identified so far is mainly employee information such as names, departments and contact details, that it is checking whether customer information exchanged in internal work communications was included, and that its exchange systems are physically separate from the groupware, with no crypto stolen. (https://www.mt.co.kr/stock/2026/10/28/2026102810330014544) - 2026-10-28: Yonhap reports that Daishin Securities (38,490 customers), Mirae Asset Global Investments and Bithumb all reported data breaches, and financial authorities began inspecting the Mirae Asset breach. (https://en.yna.co.kr/view/AEN20261028002751320) - 2026-10-27: Bithumb detects abnormal access by an unauthorized outside party to its internal mobile groupware system and a resulting personal data leak, and reports it to KISA and the Personal Information Protection Commission the same day. (https://www.yna.co.kr/view/AKR20261028043951002) ## Fix brief # Security brief: Bithumb internal groupware hacked, employee data leaked Source: https://pwn.watch/i/bithumb-groupware-breach-oct-2026 · status: live · severity: medium · updated Oct 28, 2026, 05:43 UTC ## Patch status **PARTIALLY PATCHED: some fixes exist, but not every affected branch/product is covered. Check carefully and apply mitigations where no fix exists.** ## What it is South Korean crypto exchange Bithumb detected unauthorized access by an outside party to its internal mobile groupware system on Oct 27 2026, leading to a personal data leak, and reported it to KISA and the Personal Information Protection Commission the same day. Information found so far mainly concerns employees, such as names, departments and contact details, but Bithumb has not ruled out that customer information shared in internal work files was included and is still analyzing the scope. Bithumb says its exchange systems are physically separated from the groupware and no crypto was stolen. Daishin Securities and Mirae Asset Global Investments reported separate breaches the same day. Severity detail: Employee data confirmed, customer data possibly included and still being analyzed; no funds stolen, but exchange staff and customer contact data is prime material for phishing and social engineering - Product: Bithumb internal mobile groupware (employee and possibly customer data) ## Affected versions - Not specified in the data. Check the advisories below. ## Check whether you're affected No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above. ## Fix No fixed version is listed. Follow the vendor advisory below. ## Mitigations The data marks this as partial. Until every affected component is fixed, apply the vendor mitigations from the advisories below (restrict network exposure of the affected service, disable the vulnerable feature if the advisory allows). ## Secrets to rotate This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs. ## Specific notes If you have a Bithumb account, expect phishing calls, texts and messages that impersonate Bithumb staff or quote internal details. Bithumb never asks for passwords, OTP codes or transfers to a new wallet. Watch for an official notice from Bithumb on whether customer data was included. ## Latest updates - Oct 28, 2026: Bithumb says the leaked data identified so far is mainly employee information such as names, departments and contact details, that it is checking whether customer information exchanged in internal work communications was included, and that its exchange systems are physically separate from the groupware, with no crypto stolen. - Oct 28, 2026: Yonhap reports that Daishin Securities (38,490 customers), Mirae Asset Global Investments and Bithumb all reported data breaches, and financial authorities began inspecting the Mirae Asset breach. - Oct 27, 2026: Bithumb detects abnormal access by an unauthorized outside party to its internal mobile groupware system and a resulting personal data leak, and reports it to KISA and the Personal Information Protection Commission the same day. ## Write-ups & news - [빗썸, 사내 모바일 시스템 침해로 개인정보 유출…"분석 중"](https://www.yna.co.kr/view/AKR20261028043951002) - [(LEAD) South Korean financial firms confirm data breach of customer data](https://en.yna.co.kr/view/AEN20261028002751320) - [빗썸, 사내망서 직원정보 탈취…"회원정보 유출 분석중"](https://www.mt.co.kr/stock/2026/10/28/2026102810330014544) - [Bithumb internal mobile system hacked, probing personal data leak scope](https://www.digitaltoday.co.kr/en/view/120428/bithumb-internal-mobile-system-hacked-probing-personal-data-leak-scope) ## Caveats The attacker and intrusion method are still under investigation. Money Today reports Bithumb staff used Daou Technology's DaouOffice groupware (messenger and file sharing) and that the initial entry point is believed to be the groupware, but neither Bithumb nor Daou has confirmed a flaw in that product. Bithumb said it would publish details of the incident and the leaked data. --- Machine-readable: https://pwn.watch/i/bithumb-groupware-breach-oct-2026.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.