Bitssum, a cryptocurrency exchange, experienced a security breach on the 27th when external unauthorized actors accessed its internal mobile groupware system, exposing personal information of 844 customers and 715 employees. The attack occurred between 11:28 AM and 12:27 PM on the 27th through the company's Daou Office groupware platform. The breach targeted an internal business system used by staff for work purposes, which operates separately from the exchange's core trading platform and customer asset databases, with no confirmed evidence of direct compromise to customer accounts or holdings.
Bitssum Confirms 844 Customers Affected by Groupware Breach
According to Bitssum on the 29th, a total of 6,444 customers were identified as potentially affected by the breach. However, 5,600 of these customers had their information stored in files encrypted with Digital Rights Management (DRM) technology, making external access impossible according to the exchange. The actual number of customers whose personal information was exposed stands at 844.
Exposed data categories include names, mobile phone numbers, email addresses, resident registration numbers, driver's license numbers, account numbers, and copies of identification documents. The types and scope of information leaked vary by individual customer.
The breach also compromised information belonging to 715 employees. Bitssum emphasized that the incident occurred within the mobile groupware system used by staff for business operations, which remains isolated from customer trading accounts and asset information.
Attack Occurred Between 11:28 AM and 12:27 PM on the 27th
The intrusion took place on the 27th from 11:28 AM to 12:27 PM, lasting approximately one hour. Bitssum first detected the abnormal access at 12:14 PM on the same day, after which the company blocked the attacker's access path and suspended all mobile groupware usage.
The exchange is currently conducting security inspections and vulnerability patching work in collaboration with the groupware developer.
Bitssum Reports Incident to KISA and Personal Information Protection Commission
Bitssum reported the breach to the Korea Internet & Security Agency (KISA) at 11:39 PM on the 27th, the same day the attack was detected. The exchange subsequently filed a personal information leak report with the Personal Information Protection Commission at 0:48 AM on the 28th.
Starting from the afternoon of the 29th, Bitssum began sequentially notifying affected customers individually. The company posted guidance on its website detailing the incident and response measures, allowing customers to verify whether their personal information was compromised.
Bitssum warned customers to be cautious of impersonation attempts where individuals posing as employees request authentication codes or encourage installation of specific applications. The exchange directed customers to use official customer service channels for damage reports and related inquiries. Employees were also notified to avoid clicking suspicious web links and to change passwords as preventive measures against secondary damage.
CEO Issues Apology and Commits to Security Overhaul
Bitssum CEO Lee Jae-won stated, "I deeply apologize for causing concern and anxiety to our customers." He added, "If secondary damage is confirmed for customers whose personal information was leaked, we will do our utmost to provide relief and compensation."
Lee continued, "Using this incident as an opportunity, we will fundamentally review the security system across our entire internal business infrastructure and devote all efforts to preventing recurrence."
FAQ
What personal information was exposed in the Bitssum breach on the 27th?
Exposed data includes names, mobile phone numbers, email addresses, resident registration numbers, driver's license numbers, account numbers, and copies of identification documents. The specific types and scope of leaked information vary by individual among the 844 affected customers.
When did Bitssum report the groupware hack to authorities?
Bitssum reported the breach to the Korea Internet & Security Agency (KISA) at 11:39 PM on the 27th, the same day the attack was detected. The exchange filed a personal information leak report with the Personal Information Protection Commission at 0:48 AM on the 28th.
