Flybit, a South Korean cryptocurrency exchange operated by Korea Digital Exchange, announced on the 5th that personal information of 40 customers was leaked through unauthorized external access via its groupware system operator Daou Technology. The breach exposed names, resident registration numbers or birth dates, contact information, and in some cases tax-related data that had been requested by tax collection authorities. The incident adds to a series of data breaches at South Korean crypto exchanges, with similar security incidents reported at Bithumb, Gopax, and Fravang in October.
Flybit Breach Exposes Tax-Related Customer Data
The leaked personal information consisted of tax-related data that tax collection authorities had requested from Flybit. The exposed data included names, resident registration numbers or birth dates, and contact information of 40 customers. Some records also contained tax-related information. Corporate names and corporate registration numbers were also leaked.
Flybit discovered the security breach after receiving an email from an unauthorized external entity, which prompted the company to begin an inspection. The company subsequently confirmed the personal information leak through its groupware operator.
Korea Digital Exchange Blocks System Access and Reports to Police
Following the incident, Korea Digital Exchange blocked access routes to the affected system and implemented a complete block on overseas IP address access. The company filed an investigation request with the police cybercrime unit.
Korea Digital Exchange stated that there was no intrusion into internal systems and customer assets remain safely stored. The company warned customers that the leaked personal information could be exploited for secondary damages such as website identity theft and voice phishing scams.
Korean Crypto Exchanges Report Multiple October Breaches
Bithumb announced on October 29 that personal information of 844 customers and 715 employees was leaked through a hack of its internal groupware system Daou Office. The leaked information included resident registration numbers, copies of identification documents, and account numbers.
Gopax announced on October 16 that personal information of 7 customers and 2 current and former executives, totaling 9 people, was leaked. On November 6, following recommendations from financial authorities, Gopax restricted deposit, withdrawal, and trading services to protect user assets and strengthen security.
Fravang announced on October 9 that personal information of approximately 20 customers, including 12 categories such as names, birth dates, and contact information, was leaked. On the 24th of the same month, another security incident occurred at Fravang, resulting in digital asset damages of approximately 100 million won. Fravang temporarily suspended services and announced it would compensate for the damaged assets entirely with company funds.
FAQ
What personal information was leaked in the Flybit breach?
The breach exposed names, resident registration numbers or birth dates, contact information, and in some cases tax-related information of 40 customers. Corporate names and corporate registration numbers were also leaked.
What actions did Flybit take after discovering the data breach?
Flybit blocked access routes to the affected groupware system, implemented a complete block on overseas IP address access, and filed an investigation request with the police cybercrime unit.
