Data breach

Attackers used a fake regulator account to breach Korea's Financial Security Institute assessment system, taking files from 48 financial firms

KBS and Yonhap report that the information protection assessment support system of Korea's Financial Security Institute was hacked on November 9, 2026; the institute confirmed some data leaked, blocked the system and reported to the Financial Services Commission, and files from about 48 financial firms, some 130 in total, are estimated to have leaked .

Japanese car-care products maker Soft99 announced on Nov 10 that its official online shop was accessed by an outside third party, and personal data of up to 136,968 members and shoppers may have leaked .

The Japan Chamber of Commerce and Industry (JCCI) announced on Nov 10 that the external exam management server used for its online tests was accessed without authorization, and data of up to about 980,000 examinees (about 1.

OTC-listed Shen's (8921) said in a November 10 filing that customers of its Jcolor e-commerce platform reported that a third party appears to have improperly obtained data and contacted them by email .

OTC-listed Hi-Lai Foods (1268) said in a November 10 material announcement that it was notified that day by its outsourced shopping mall vendor Cyberbiz of a security incident in which part of the vendor database was accessed without authorization, involving order data of some customers of its online mall .

Listed company HeySong (1234) said in a November 10 material announcement that its outsourced online store vendor Cyberbiz notified it of unauthorized anomalous access to part of the vendor database, which includes HeySong online store order data .

iThome reports that Maywufa (1731) filed a material disclosure on November 9 saying that on November 6 online store members reported a suspected personal data leak, which initial findings link to its outsourced e-commerce platform provider’s system, with the exact cause and scope still under investigation .

CNA reports that Taiwanese online travel agency ezTravel detected an external attack on its member center on Nov 7, and some historical order contact data was improperly obtained, affecting more than 690,000 people .

A material notice republished by MoneyDJ says Taiwan Sakura (9911) was notified on Nov 9 by its e-commerce vendor Cyberbiz that some data in Cyberbiz's database, which holds orders and personal data from the SAKURA official online store, was accessed without authorization .

iThome reports that 曜亞 (4138) filed a cybersecurity material disclosure on the evening of November 9 saying the DR CYJ online store of its subsidiary 曜胜生技 was affected by a security incident at e-commerce provider 順立智慧 (Cyberbiz), with order-related data accessed without authorization .

iThome reports that Topco (5434) filed a cybersecurity material disclosure on MOPS on November 9 saying the e-commerce outsourcing provider of its subsidiary 安永生活 (Anyong), 順立智慧, recently experienced abnormal data access .

NTT Data announced on Nov 9 that the sign-up service for Sumitomo Life's standalone Vitality programs, which it builds and operates under contract, was accessed by a third party and personal data of about 80,000 users leaked .

Japanese furniture retailer Nitori Holdings said on November 9 that it confirmed unauthorized third-party access to a system it manages on November 6 and that up to 37.

BleepingComputer reports that a threat actor using the ShinyHunters handle, believed to be impersonating the extortion gang, is selling what they claim are records of 335 million Binance users on a new underground forum and asking $900,000 .

On November 8, 2026, Taipei Exchange-listed Nobel Baby Co.

According to United Daily News, a 38-year-old man surnamed Lin in Kaohsiung used AI to write scripts to illegally breach the website backends of government agencies and private enterprises, stealing over 230,000 personal data records of citizens and selling them on the dark web .

Japanese indoor golf school operator Step Golf said in a second notice on Nov 10 that it was accessed without authorization on Oct 23 and 25, and database backup files containing personal data were very likely leaked .

Amplifon Americas said an unauthorized third party obtained files from certain systems between Jan 18 and Feb 8, 2026; it detected suspicious activity on Feb 11 and determined on Oct 6 that personal information may have been affected .

Mirae Asset Securities announced that its internal groupware system, mi-global, suffered an external attack on November 5, leaking personal data of approximately 35,255 employees, including former and outsourced personnel .

Taiwan Fund for Children and Families (TFCF) announced on November 7 that starting November 6, donors reported receiving fraudulent messages impersonating the foundation and directing them to add a fake official LINE account .